I've written a custom login script for my Forms Based Authentication SharePoint 2010 Server website, which allows my users to enter credentials for one of our products, and map them to a FBA user account. Using the code below I then log the user in.

System.IdentityModel.Tokens.SecurityToken token = SPSecurityContext.SecurityTokenForFormsAuthentication(new Uri(SPContext.Current.Web.Url), Membership.Providers["FBAMembershipProvider"].Name, Roles.Providers["FBARoleProvider"].Name, FBAUserName, FBAPassword);

I'm finding that the FedAuth cookie that SharePoint creates is being set to expire in only 10 hours (I logged in and the cookie was created at 16:45 Central, and it expires at 7:47am GMT).

Is there a way to increase the expiration to the fairly standard 30 days?

Also, using this code I was unable to find a way to allow a "keep be logged in" checkbox on my form, so the user is, I believe, always logged in, albeit for around 10 hours.

Any advice I can get would be appreciated.


search cookieHandler in web.config of your webapplication, then add the persistentSessionLifetime property:

<cookieHandler mode="Custom" path="/" persistentSessionLifetime="1.0:0:0">


it seams the property just have effect on the regular cookie expire time, sharepoint write it's own token life time in the FedAuth cookie value.

try to run this codes in powershell (sharepoint management shell) to set the token life time.

$exprie = 60*24*31 # 31 days
Set-SPSecurityTokenServiceConfig -FormsTokenLifetime $exprie

blow is the code to get the token life time from local cookie

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Xml;
using System.Net;
using System.Runtime.InteropServices;

namespace ConsoleApplication3
    class Program
        static void Main(string[] args)
            var cookie = GetCookie("http://ericinbj-dev").Replace(' ', '+').Substring(8);
            var decodedCookie = Decode(Convert.FromBase64String(cookie));
            var time = new DateTime(long.Parse(decodedCookie.Split(',')[1]));

            Console.WriteLine(time.AddYears(1600)); // don't know why, the time decode from cookie was 1600 yeas ago ...


        internal static string Decode(byte[] token)
            string decodedCookie = null;
            if (token != null)
                using (XmlReader reader = XmlDictionaryReader.CreateTextReader(token, XmlDictionaryReaderQuotas.Max))
                    using (XmlReader reader2 = XmlDictionaryReader.CreateDictionaryReader(reader))
                        if (reader2.IsStartElement("SP"))
                            decodedCookie = reader2.ReadElementContentAsString();

            return decodedCookie;


        public static string GetCookie(string uri)
            uint datasize = 8192 * 16;
            StringBuilder cookieData = new StringBuilder((int)datasize);
            if (!InternetGetCookieEx(uri.ToString(), null, cookieData, ref datasize, INTERNET_COOKIE_HTTPONLY, IntPtr.Zero))
                if (datasize < 0) return null;           
                cookieData = new StringBuilder((int)datasize);
                if (!InternetGetCookieEx(uri.ToString(), null, cookieData, ref datasize, INTERNET_COOKIE_HTTPONLY, IntPtr.Zero))
                    return null;

            return cookieData.ToString();

        [DllImport("wininet.dll", SetLastError = true)]
        private static extern bool InternetGetCookieEx(string pchURL, string pchCookieName,
                       StringBuilder pchCookieData, ref System.UInt32 pcchCookieData,
                       int dwFlags, IntPtr lpReserved);

        private static int INTERNET_COOKIE_HTTPONLY = 0x00002000;
  • Thanks for the reply, Eric. I've just implemented this answer, and will check over the next couple of days to see if it has indeed solved my issue - and if (when <g>) it does, I will mark this as the answer :) – QMKevin Mar 28 '12 at 22:38
  • You did answer my question, so I have marked your post as such. However, Having logged in to my SharePoint yesterday, following implementing your answer, I was prompted to log in again this morning. I can see the FedAuth cookie is now set to expire on April 28th, but SharePoint doesn't seem to recognize that? Any ideas? – QMKevin Mar 29 '12 at 18:29
  • persistentSessionLifetime="1.0:0:0" is set the expire time to 1 day, set the value to "30.0:0:0" ? – Eric Apr 1 '12 at 3:32
  • Yeah, I forgot to mention that I had set that value to "30.0:0:0" when I implemented your answer. Didn't seem to work. I think the issue is with my code above, but I'm not sure. – QMKevin Apr 3 '12 at 15:35
  • new approach added in the answer. you may try again, and make sure the persistentSessionLifetime set to a value not less than FormsTokenLifetime – Eric Apr 5 '12 at 6:01

You will need to use Powershell to set the token life time of the security token service. the Default life time is 10 hours. You can find more information at How to Set Forms Authentication Timeout?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.