Here is something I came across that was very interesting. In asp.net we can set the time out for both Form Authentication and Session. These two times can be different.

Hence you can have Forms Authentication time-out is greater than the Session time-out.

[Note: there is a difference in Version 2.0 from V1.X that the value for cookie Expiree (Time-out) is set for both the persistent and non-persistent setting (previously it was only used for the non-persistent case). Previously, the persistent duration was just hard-coded to a really long time]

Although it’s a little bit hard for me to understand how you can time-out and persistent cookie and still say it’s persistent.

Now when we configure the Forms Authentication in the web.config we can set the value for SetAuthCookie (This is the second parameter). This indicates whether the browser should save the cookie persistently or expires it when the browser shut down.

So we can have

FormsAuthentication.SetAuthCookie("VikramLakhotia",
true);

Or

FormsAuthentication.SetAuthCookie("VikramLakhotia",
false);

In the first case we will cause the cookie to persist
And in the second case the cookie will not persist.

So what can be Interesting in it?

Here is what is interesting. Now lets say we are using Forms Authentication with SetAuthCookie =true. (The first Scenario)

Now if I login to the Site, and then close the browser and start a new browser (no ctrl + n) or file-> new but opening in a new window)) and go the same site. You would be thinking of being logged in again but that’s now true. Although each independently started browser creates a new session but you will still find your self logged in. The reason is the second parameter in the Forms Authentication. We have left the SetAuthCookie true. Which means the cookie will survive the browser restart. So if you want the Forms Authentication to force a new login every time a browser starts use the second option. Or else you can also make a checking in the session start event to see if the user is authenticated or not. If the user is authenticated then we can load the session data again for the given user.

[Note the default timeout for Forms Authentication has been changed to 30 minutes in ASP.NET 2.0]

Hope this Helps
Thanks
Vikram