WebMatrix WebSecurity: Keeps logging out user randomly - session

Question

I'm using WebMatrix and applied a login system on my website. I'm running into a strange problem. My website keeps randomly logging out the user. Happens unexpectedly. Not only on my code, but happens in the WebMatrix sample projects as well.
My Web.Config file is:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appSettings>
<add key="loginUrl" value="~/login" />
</appSettings>
<system.web>
<compilation debug="true" targetFramework="4.0" />
<sessionState timeout="20" />
<!-- This is for links with incorrect file extensions -->
<!-- This only handles .NET based errors, not classic web like HTML or ASP based extensions -->
<customErrors mode="Off">
<error statusCode="403" redirect="/Shared/Error404.cshtml" />
<error statusCode="404" redirect="/Shared/Error404.cshtml" />
<error statusCode="500" redirect="/Shared/Error500.cshtml" />
</customErrors>
</system.web>
<system.webServer>
<!-- This handles all other types of link errors -->
<httpErrors errorMode="Custom">
<remove statusCode="404" subStatusCode="-1" />
<error statusCode="404" path="/Shared/Error404.cshtml" responseMode="ExecuteURL" />
</httpErrors>
</system.webServer>
<system.data>
<DbProviderFactories>
<remove invariant="System.Data.SqlServerCe.4.0" />
<add invariant="System.Data.SqlServerCe.4.0" name="Microsoft® SQL Server® Compact 4.0" description=".NET Framework Data Provider for Microsoft SQL Server Compact" type="System.Data.SqlServerCe.SqlCeProviderFactory, System.Data.SqlServerCe, Version=4.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91" />
</DbProviderFactories>
</system.data>
</configuration>
I've defined the session timeout as 20 minutes. I use the same plain way of logging in the user.
if (WebSecurity.Login(email, password, rememberMe)) {
Context.RedirectLocal(returnUrl);
return;
} else {
ModelState.AddFormError("The user name or password provided is incorrect.");
}
And this is how I check whether my user is signed-in or not in secured pages:
if (!WebSecurity.IsAuthenticated) {
Response.Redirect("~/login", true);
}
I've searched a bit on google, there are few people who have also been complaining that WebMatrix WebSecurity randomly logs out user. Sometimes when an activity is performed, like form submission or sometimes a simple url click.
Any ideas or suggestions? Someone even suggested me to dump Razor and move to MVC, it doesn't have this problem. I'm not sure whether thats true.
UPDATE
I have the following code in top of all my secured pages (which require user being logged in). Does anyone think this would be causing the issue?
// Ensure this page is not cached
Response.Expires = -1;
Response.Cache.SetNoServerCaching();
Response.Cache.SetAllowResponseInBrowserHistory(false);
Response.CacheControl = "no-cache";
Response.Cache.SetNoStore();
Thanks
-Faraz Azhar

Answer 1

I will have to check further, i remember some weirdo setting to increase the cookie stay-logged-in time. Here's what's in my config and i don't see anything else that has a time:
<system.web>
<customErrors mode="RemoteOnly" defaultRedirect="~/error/"></customErrors>
<compilation debug="true" targetFramework="4.0" />
<authentication>
<forms timeout="10080" />
</authentication>