I have an ASP.NET MVC application using forms authentication. Here's the line of code where I create the auth token:
FormsAuthentication.SetAuthCookie(username, true);
My web.config contains:
<system.web>
<machineKey validationKey="{unique key}" decryptionKey="{unique key}" validation="SHA1" decryption="AES" />
<authentication mode="Forms">
<forms loginUrl="~/account/" timeout="2880" />
</authentication>
...
</system.web>
<location path="my">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
Despite the parameter for the persistent cookie being set to true, my users get logged out after a few days of inactivity.
The app is deployed to AppHarbor, but I experienced the same behavior when it was hosted on a dedicated server.
What am I missing that would cause users to get logged out sporadically?