Session end?

[feng]

I just observed an odd session end behavier: My code in
Global.asax's Session_end method has been executed --
which tells me that my session has terminated. But when I
click a link, after pausing a minutes or so, on the idle
page, instead of leading me to my login page, as it
normally does with any new session, it directly bring me
to the page the link points to. What's going on here? Has
the session ended or not?

 

[Mark Fitzpatrick]

Are you using Forms authentication? A lot of people confuse the timout limit
of forms authentication with sessions since they usually both default to 20
minutes. In fact though, they have nothing to do with eachother since the
Forms authentication uses it's own cookie.

Hope this helps,
Mark Fitzpatrick
Microsoft MVP - FrontPage

 

[feng]

Thanks for your reply.

What happens if I do the following: I set session timeout
to 10 minutes and leave the forms authentication as
default. Then I login from my form authentication page,
access one page and wait 10 more minutes. Now my session
expires and, after that, I try to click on a link on the
idle page.

What should I get now? a page pointed to by the link? or
my login form?

My understanding has been that I should get login page,
beacuse my session expired. A new session should always
start with the authentication form. You can't go directly
to a page that's protected by the authentication.

Am I wrong?

Please help.