I have a passive STS set up for a new application I'm working on.
I've noticed that when a user's session expires, the user is still authenticated. I would have thought that when the session expires, the user would no longer be authenticated. My boss discussed this with me as I am currently charged with setting up the authentication. He says that it would be good if we could make the user's log on expire after a certain period of inactivity similar to how the session expires.
I am familiar with how to sign a user out with a few lines of code. How can I make it so that the user is automatically signed out after a specified period of inactivity?
Currently, I have some code in the global.asax
file that programmatically checks when the last request was and compares it to the current time; it then signs the user out if a certain period of time has expired.