Hi,
I am using database with a list of username/passwords, and simple web form that allows for users to enter their username/password.
When they submit the page, I simply do a stored procedure check to authenticate. If they are authorised, then their user details are stored in am object and then in a session. This custom User object that I created is used throughout the web application, and also in a sub-site (session sharing).
My question/problems are:
1. Is my method of authentication the correct way to do things?
2. I find users complaining that their session expired although they "were not idle", possibly due the app pool recycling? They type large amounts of text and find that their session had expired and thus losing all the text typed in. What am I doing wrong?
3. Should I be storing the User Object in a session, cookie or something else instead in order to be more "corr ...
Go to the complete details ...