How to Set Forms Authentication Timeout?

Question

I have a public facing SP2010 site that uses forms authentication (default ASP.NET membership provider). I noticed that The user stays logged in even after hours of inactivity.

We need the user to be automatically log out and having to re-login before accessing the site again after a period of inactivity (typically 30 minutes).

What can I do in order to force the user to re-login after 30 minutes?

The token is generated using the call

token = SPSecurityContext.SecurityTokenForFormsAuthentication(
                appliesTo,
                authProvider.MembershipProvider,
                authProvider.RoleProvider,
                username,
                password);

For some reason, the token is always valid for 10 hours (validTo property is always 10 hours after the validFrom property). I spent sometime looking in config files to see where this 10 hours is coming from but to no avail.

I then decomipled the SharePoint assembly to see where it is reading the 10 hours setting from.

after tracing the calls I found out that it is hardcoded to 10 hours in the Assembly

Check below (decomplied code)

public virtual SecurityToken GetTokenFromResponse(RequestSecurityToken request, RequestSecurityTokenResponse response)
{
    DateTime? nullable;
    DateTime? expires;
    if (response != null)
    {
        if (response.IsFinal)
        {
            if (response.RequestedSecurityToken != null)
            {
                SecurityToken securityToken = response.RequestedSecurityToken.SecurityToken;
                if (securityToken != null)
                {
                    return securityToken;
                }
                else
                {
                    if (response.RequestedSecurityToken.SecurityTokenXml != null)
                    {
                        SecurityToken proofKey = WSTrustChannel.GetProofKey(request, response);
                        if (response.Lifetime == null)
                        {
                            nullable = new DateTime?(DateTime.UtcNow);
                            DateTime utcNow = DateTime.UtcNow;
                            expires = new DateTime?(utcNow.AddHours(10));

Answer 1

Do the following powershell command:

$sts = Get-SPSecurityTokenServiceConfig
$sts.FormsTokenLifeTime = (New-TimeSpan -minutes 30)
$sts.Update()
Get-SPSecurityTokenServiceConfig