Users being forced to re-login randomly, before session and auth ticket timeout values are reached - authentication

Question

I'm having reports and complaints from my user that they will be using a screen and get kicked back to the login screen immediately on their next request. It doesn't happen all the time but randomly. After looking at the Web server the error that shows up in the application event log is:
Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Everything that I read starts out with people asking about web gardens or load balancing. We are not using either of those. We're a single Windows 2003 (32-bit OS, 64-bit hardware) Server with IIS6. This is the only website on this server too.
This behavior does not generate any application exceptions or visible issues to the user. They just get booted back to the login screen and are forced to login. As you can imagine this is extremely annoying and counter-productive for our users.
Here's what I have set in my web.config for the application in the root:
<authentication mode="Forms">
<forms name=".TcaNet"
protection="All"
timeout="40"
loginUrl="~/Login.aspx"
defaultUrl="~/MyHome.aspx"
path="/"
slidingExpiration="true"
requireSSL="false" />
</authentication>
I have also read that if you have some locations setup that no longer exist or are bogus you could have issues. My path attributes are all valid directories so that shouldn't be the problem:
<location path="js">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="images">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="anon">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="App_Themes">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="NonSSL">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
The only thing I'm not clear on is if my timeout value in the forms property for the auth ticket has to be the same as my session timeout value (defined in the app's configuration in IIS). I've read some things that say you should have the authentication timeout shorter (40) than the session timeout (45) to avoid possible complications. Either way we have users that get kicked to the login screen a minute or two after their last action. So the session definitely should not be expiring.
Update 2/23/09: I've since set the session timeout and authentication ticket timeout values to both be 45 and the problem still seems to be happening.
The only other web.config in the application is in 1 virtual directory that hosts Community Server. That web.config's authentication settings are as follows:
<authentication mode="Forms">
<forms name=".TcaNet"
protection="All"
timeout="40"
loginUrl="~/Login.aspx"
defaultUrl="~/MyHome.aspx"
path="/"
slidingExpiration="true"
requireSSL="true" />
</authentication>
And while I don't believe it applies unless you're in a web garden, I have both of the machine key values set in both web.config files to be the same (removed for convenience):
<machineKey
validationKey="<MYVALIDATIONKEYHERE>"
decryptionKey="<MYDECRYPTIONKEYHERE>"
validation="SHA1" />
<machineKey
validationKey="<MYVALIDATIONKEYHERE>"
decryptionKey="<MYDECRYPTIONKEYHERE>"
validation="SHA1"/>
Any help with this would be greatly appreciated. This seems to be one of those problems that yields a ton of Google results, none of which seem to be fitting into my situation so far.

Answer 1

It may also be worth checking the Maximum Worker Processes property for your application pool. If you are using in memory session and have more than one as the max worker process you can find session issues as a users request is handled by a different thread that is unaware of their session.

Answer 2

Since you have noted that you are using a very specific FQDN for your site, do you have any other .Net applications running under the same FQDN just different virtual paths? The name of the auth cookie might be the same for both applications, but the token will be different. So if I log into www.domain.com and then to www.domain.com/app2, I will no longer have correct authentication for app1.

Answer 3

1.) Check how often your iis process gets recycled. (Turn on logging and check your settings). After a recycle, using the default in proc session store, the session is lost.
2.) Does your application spawn Threads that may throw an Exception (which are btw not displayed to the user)? Because if that situation exists the iis recycles processes far more often.

Answer 4

I have just finished dealing with this precise problem, exactly as described in the question and the issue was some missing config in web.config.
When using formsAuthentication, you need to stop having the session handle authentication, as the cookie is now responsible for it.
This line needs to be added (or updated) in your web config, in the "system.web" element
<sessionState mode="Off">
sessionState and formsAuthentication should not both be active. I don't understand the fine details of how they interfere with each other, but in this case, it produced random log outs of random users at random times.

Answer 5

Our site has stumbled with the same problem for years, but yesterday we found a fix, see my question. As a commenter suggested, I tried adding this to web.config:
<sessionState mode="InProc" timeout="60" />
Apparently, the timeout must be set both in sessionState and in the ticket. See also ms docu in https://msdn.microsoft.com/en-us/library/ms178586.aspx
To more accurately measure the actual timeout while in debug mode, I found it handy to add Debug.WriteLine calls in file Global.asax.cs in methods Session_Start() and Session_End(), with millisecond time added using
string.Format("{0:HH:mm:ss.fff} - {1}", DateTime.Now, strMessage);
so that you can login, go for lunch, let the session time out, and read the time stamps at some convenient moment in the VisualStudio Output window.