I have an asp.net application which is currently using forms authentication with slidingExpiration="true". In web.config, we have the following:
<authentication mode="Forms">
<forms loginUrl="Mylogin.aspx" timeout="15" slidingExpiration="true"/>
</authentication>
This is all to spec: There is a sliding 15 minute expiration. However, we now have a new security requirement: Users must re-authenticate every 24 hours, even if they have been "active" the whole time. In other words, even if you clicked a link in the site every minute for 24 hours straight after logging in, after 24 hours, you will be automatically logged out and redirected to the login page.
But slidingExpriation is true/false only. There is no "both" feature (e.g. have slidingExpirationTimeout="15" and absoluteExpirationTimeout="1440") as far as I can tell.
Except for rolling my own solution, is there a way to implement this using the built in forms authentication?
Thanks in advance.