How can I handle forms authentication timeout exceptions in ASP.NET?

This is why many systems include timers on the page to give approximate timeout times. This is tough with interactive pages. You really need to hook ajax functions and look at the return status code, which is a bit difficult. One alternative is to use code based on the following which runs early in the page lifecycle and perform an ajax redirect to a login page. Otherwise you are stuck trying to intercept the return code from ajax and in asp.net where the ajax is done 'for you' (ie not a more manual method like jQuery) you lose this ease of detection.

http://www.eggheadcafe.com/tutorials/aspnet/7262426f-3c65-4c90-b49c-106470f1d22a/build-an-aspnet-session-timeout-redirect-control.aspx

for a quick hack you can try it directly in pre_init http://forums.asp.net/t/1193501.aspx

Edit what is wanted are for forms auth timeouts, not session timeouts. Forms auth timeouts operate on a different scale than session timeouts. Session timeouts update with every request. Forms auth tickets aren't actually updated until half of the time goes by. So if you have timeouts set to an hour and send in one request 25 minutes into it, the session is reset to an hour timeout, the forms auth ticket isnt touched and expires in 35 minutes! To work around this, sync up the session timeout and the forms auth ticket. This way you can still just check session timeouts. If you don't like this then still - do the below and sync up the timeouts and then parse the auth ticket and read its timeout. You can do that using FormsAuthentication.Decrypt - see:

Read form authentication cookie from asp.net code behind

Note that this code requires that upon login you set some session value - in this case its "UniqueUserId". Also change the login page path below to fit yours.

 protected void Application_PreRequestHandlerExecute(object sender, EventArgs e) { //Only access session state if it is available if (Context.Handler is IRequiresSessionState || Context.Handler is IReadOnlySessionState) { //If we are authenticated AND we dont have a session here.. redirect to login page. HttpCookie authenticationCookie = Request.Cookies[FormsAuthentication.FormsCookieName]; if (authenticationCookie != null) { FormsAuthenticationTicket authenticationTicket = FormsAuthentication.Decrypt(authenticationCookie.Value); if (!authenticationTicket.Expired) { if (Session["UniqueUserId"] == null) { //This means for some reason the session expired before the authentication ticket. Force a login. FormsAuthentication.SignOut(); Response.Redirect("Login.aspx", true); return; } } } } }  

If you're using Forms Authentication, the user will be redirected to the login page when the Forms Authentication ticket expires, which is not the same as the Session expiring.

You could consider increasing the Forms Authentication timeout if appropriate. Even to the extent of using a persistent cookie. But if it does expire, there's no real alternative to redirecting to the login page - anything else would be insecure.

One way to deal with Session timeouts is to use Session as a cache - and persist anything important to a backing store such as a database. Then check before accessing anything in Session and refresh if necessary:

MyType MyObject { get { MyType myObject = Session["MySessionKey"] as MyType if (myObject == null) { myObject = ... get data from a backing store Session["MySessionKey"] = myObject; } return myObject; } set { Session["MySessionKey"] = value; ... and persist it to backing store if appropriate } } 

If you're using a master page or a base page, I would add some logic to one of the events in the page lifecycle to check whether the session is new:

protected void Page_Load(object sender, EventArgs e) { if (Session.IsNewSession) { //do whatever you need to do } }