I'm coding my sliding expiration algorithm for Bearer tokens to mimic what's done by Microsoft on their FormsAuthentication logic, and reading their documentation they say (emphasis added)

When the SlidingExpiration is set to true, the time interval during which the authentication cookie is valid is reset to the expiration Timeout property value. This happens if the user browses after half of the timeout has expired

What's the reasoning behind waiting for that instead of just increasing the cookie's expiration every time a user browses a page?


No particular reason, it seems a good balance between updating it on every request and not leaving it too late that it expires before the next user action is initiated.

Take two scenarios with a 20 minute expiry.

A user visit of 9 minutes, * denotes a page view:

*      * *

This has the advantage of short visits not having to issue an updated ticket.

A user visit of 25 minutes:

*    *         *
               ^ as half the time has passed, a new ticket is issued to expire 20 minutes ahead:
                                   ^ new ticket....

This enables the user to continue browsing without having to log in again for longer visits.

As the server doesn't know about users browsing that are not making requests (page views in my example), only updating the expiry time after half of the duration seems a reasonable way of keeping sessions alive.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.