IIS / .ASP force logout question

[RabbieBurns]

I have a website created that requires users to login via their active directory account.

It seems with IE they stay logged in until they close the browser It seems with IE they stay logged in until they close the browser . A lot of users log in from home, so Im looking for a way to force a logout the site after X mins.

I have been dabbling with cookies, but am unsure if this is the right way to do it, as they are not logging in to the actual site per se (Although I would love to add a second level of security by having a login page on the actual site - but have no idea about that now)

Is there a way in IIS to force the logout of an authenticated session after a certain amount of time?

[powdarrmonkey]

If you're just doing authentication with a normal IIS protected directory, then no you can't time it out (the browser just keeps on presenting its credentials with every page request). You need to use a cookie-based authentication that you can control a bit more. I don't know if ASP has an equivalent to PHP's sessions system, but that would be your best bet.

[SYNACK]

It is not to difficult to set up forms based authentication with ASP there is a nice write up on cookie based stuff here with code:
ASP 101 - Articles

Heres one that uses a DB:
Simple ASP Authentication System

there is a whole list of tutorials here:
ASP User Authentication Tutorials - Tutorialized

Once you get the hang of it the session based stuff in ASP is easy to use as it does most of the work for you.

[RabbieBurns]

Thanks, Ill check those links out tomorrow and try to knock something together

[RabbieBurns]

Heres one that uses a DB:
Simple ASP Authentication System[/URL]

Once you get the hang of it the session based stuff in ASP is easy to use as it does most of the work for you.

Used this one, piece of cake to setup, and I have created a logout button as it doesn't use cookies so I don't think I can auto time it out.

Slightly off topic now, but can anyone post code I could use to somehow mangle the passwords stored in the database so they aren't plain-text?

[SYNACK]

MD5 hashing although easily broken now via Google sounds like it would fit the bill as it is what is used in most situations:

AspEncrypt.com - Encrypt Your Password Database with a One-way Hash
http://webcheatsheet.com/asp/md5_enc...ds.php?print=Y
http://www.planet-source-code.com/vb...=9367&lngWId=4

[RabbieBurns]

thanks, ill check that out tomorrow.

I also managed to add an auto time out to the stuff I did today by adding a session expire line to the .asa