We have a website that automatically logs out after 20 minutes of idle time. Below is code in _layout.ts:
var idleMax = 200;// Logout after 20 minutes of IDLE
var idleTime = 0;
var baseUrl = '<some url>'; // like: 'http://localhost/'
var webServerUri = '<some url>'
function timerIncrement() {
idleTime = idleTime + 1;
if (idleTime > idleMax) {
idleTime = 0;
$.ajax({
url: baseUrl + "Sys/Home/Logoff"
});
window.location.replace(webServerUri + "Sys/Home/Login?returnUrl=" + window.location.href.replace(/&/gi, "%26") + "&isInactive=-1");
}
}
HomeController.cs:
Sys/Home/Logoff:
public ActionResult Logoff()
{
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
Response.Cache.SetNoStore();
HttpContext.GetOwinContext().Authentication.SignOut();
return Redirect(VirtualPathUtility.ToAbsolute("~/") + "sys/Home/Login");
}
Login action: (showing login page):
[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
ViewBag.ReturnURL = returnUrl;
if (!String.IsNullOrWhiteSpace(returnUrl))
{
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
Response.Cache.SetNoStore();
// HttpContext.GetOwinContext().Authentication.SignOut();
ViewBag.ReturnURL = returnUrl.Replace("&", "%26");
}
return View();
}
login.cshtml has begin form section as below:
@using (Html.BeginForm(new { ReturnUrl = ViewBag.ReturnUrl }))
{
@Html.AntiForgeryTokenNoEx()
.
.
.
.<Other code>
.
.
.
.
}
User log out after 20 minutes of idle time. then we again enter same username and password and it gives below error:
The provided anti-forgery token was meant for a different claims-based user than the current user