.Net MVC - Display "session expired" only for private pages - asp.net-mvc-4

Question

I'm developing a .NET MVC 4 application that needs to show a message for "Session expiration" to the user if he performs some action after the session timeout.
I'm using forms authentication with a very long timeout and a sesion with a shorter timeout, so I can know if the session expired or it's a new visitor. This is my Web.config section for that:
<authentication mode="Forms">
<forms loginUrl="~/Login" timeout="10080" defaultUrl="~/Index" />
</authentication>
<sessionState mode="InProc" timeout="20" />
As I said, that's only to differentiate a new visitor from a session timeout, and not necessary for the application itself. It can be changed if the same result can achieved with something else.
With that in the Web.config, I can do the following in the Global.asax:
protected void Session_Start(object sender, EventArgs e)
{
//if it's a new session AND the user is authenticated, then it's a session timeout
if (Request.IsAuthenticated)
{
if (Request.RequestContext.HttpContext.Request.IsAjaxRequest())
{
//...
//Ajax handling code
//...
//The redirect is so I can return a JsonResult with a standard object with the message
Response.Redirect("/GetJson?some_parameters, true);
}
else
{
Response.Redirect("/SessionExpired", true);
}
}
}
All that works great for the private sections of the website that require login. The problem is that if a user is logged, wait for the session timeout, and then try to open a "public" page, one that doesn't require login, he still gets the "Session expired" message. That's what I want to avoid. The "Session expire" message should only be showed to the user if he's trying to access a page that requires log in.
I've tried to set a flag in Session_Start and redirect in a later event of Global.asax, but it didn't work because I had some variable accessibility issues.
I thought of trying to check if the current action has the [AllowAnonymous] attribute so I can skip the redirect, but I couldn't figure out how.
Some answers that I read gave me the impression that my "Session expire" logic should be in a custom attribute but I don't know if that's the right approach.
My question would be, what's the best way of accomplish the "Session expire" for only "private" pages in .Net MVC 4?

Answer 1

As you say, the ideal is to use an attribute. To be more exact this attribute is named "Action Filter".
You can create an ActionFilter implementing an interface, or inheriting an existing one.
In your case I think the easiest way to get your result is to inherit AuthorizeAttribute, and override its OnAuthorization method.
In this method you can access the HttpContext as a property of the filterContext parameter: filterContext.HttpContext. You can check the session, authorization, and check if it's an ajax request using this property. If you need to redirect, you must do it by setting a property of filterContext parameter:
filterContext.Result = new RedirectResult("...url to redirect to...");
You can use any overload of RedirectResult or RedirectToRouteResult constructor.
If you leave the Result property untouched, nothing special will happen.
The you can use this custom attribute instead of the original authorization attribute.