title: Issues with storing the custom Principal in Session for ASP.NET MVC
body: <p>I am running into an issue with ASP.NET MVC where it is forcing the user to log back in after about 20 mins of inactivity.</p>
  
  <p>I am using Forms Authentication and have increased the time-out in the config file as:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/LogOn" timeout="9999999" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>I am also setting the session time-out in the config file as:</p>
  
  <pre><code>&lt;sessionState timeout="120"&gt;&lt;/sessionState&gt;
  </code></pre>
  
  <p>I am basing this off of Rockford Lhotka's CSLA ASP.NET MVC example and have the following in my global.asax:</p>
  
  <pre><code>    protected void Application_AcquireRequestState(object sender, EventArgs e)
      {
          if (HttpContext.Current.Handler is IRequiresSessionState)
          {
              if (Csla.ApplicationContext.AuthenticationType == "Windows")
                  return;
              System.Security.Principal.IPrincipal principal;
              try
              {
                  principal = (System.Security.Principal.IPrincipal)
                      HttpContext.Current.Session[MyMembershipProvider.SESSION_KEY];
              }
              catch
              {
                  principal = null;
              }
              if (principal == null)
              {
                  if (this.User.Identity.IsAuthenticated &amp;&amp; this.User.Identity is FormsIdentity)
                  {
                      // no principal in session, but ASP.NET token
                      // still valid - so sign out ASP.NET
                      FormsAuthentication.SignOut();
                      this.Response.Redirect(this.Request.Url.PathAndQuery);
                  }
                  // didn't get a principal from Session, so
                  // set it to an unauthenticted PTPrincipal
                  BusinessPrincipal.Logout();
              }
              else
              {
                  // use the principal from Session
                  Csla.ApplicationContext.User = principal;
              }
          }
      }
  </code></pre>
  
  <p>From what I can tell it should ONLY time-out after 120 minutes of inactivity ... but for some reason it always seems to time-out after 20 minutes of inactivity. I have know idea why this is happening, any ideas?</p>
  
  <p>I am toying with the idea of just dumping Forms Authentication and handling it myself via Session, but I'm afraid I would lose functionality like [Authorize] attributes and so on. Trying not to go down this path. </p>
  
  <p>Is it possible to store my custom principal object as a cookie? I just don't want to have to authenticate/authorize a user for every single page or action.</p>
  
  <p>I'm losing hair ... rapidly! =)</p>