asp.net - 启用了slideExpiration的FormsAuthentication不会在每个请求中返回cookie。

Question

我有一个带有FormsAuthentication且web.config中带有slidingExpiration="true"的Web应用程序，但在每个请求中都没有返回cookie，但是当我看到HTTP事务时，我看不到Web服务器在每个请求中都返回了AUTH cookie。

检查docs，应该。

slidingExpiration Optional attribute. Specifies whether sliding expiration is enabled. Sliding expiration resets the active authentication time for a cookie to expire upon each request during a single session. This attribute can be one of the following values. Value Description True Specifies that sliding expiration is enabled. The authentication cookie is refreshed and the time to expiration is reset on subsequent requests during a single session. False Specifies that sliding expiration is not enabled and the cookie expires at a set interval from the time the cookie was originally issued. The default is True.

有谁知道为什么它不能按预期工作？

干杯。

Answer 1

我读过这个:http://www.dotnetmonster.com/Uwe/Forum.aspx/asp-net-security/2316/problem-with-slidingExpiration

In other words, if the elapsed time since ticket creation is greater then half the ticket timeout (in your scenario would be 1 minute) the the ticket won't be renewed. Otherwise a new ticket will be granted with a fresh timeout (2 mins in your case). Summarizing, if you hit your page after 1 minute, it won't extend your Forms session lifetime regardless your slidingExpiration setting.

这是有道理的，但我找不到任何官方消息来源。所以有空的时候我会自我测试。

干杯。