We currently have a set of ASP.NET application and we are migrating them to use Windows Authentication (used to be form Authentication). We will eventually let the user to connect to our site entering Windows Authentication credentials. When we tested within our system across different domains, we noticed that the authentication session seemed to be cached even with the server session had timed out. In other words, once the user logged in and keeped an Internet Explorer window up (didn't even have to be in our application page), the user could always navigate back to our application without being prompted for security login again. We had our site included in the Trusted Site list of the IE browser.
Is that the expected behavior for ASP.NET Windows Authentication? If that is the case, is there a way to end the Authentication cache when the users leave their IE windows idle?
Thanks
Sai Kit
...
Go to the complete details ...