I have a public facing SP2010 site that uses forms authentication (default ASP.NET membership provider). I noticed that The user stays logged in even after hours of inactivity.

We need the user to be automatically log out and having to re-login before accessing the site again after a period of inactivity (typically 30 minutes).

What can I do in order to force the user to re-login after 30 minutes?

The token is generated using the call

token = SPSecurityContext.SecurityTokenForFormsAuthentication(

For some reason, the token is always valid for 10 hours (validTo property is always 10 hours after the validFrom property). I spent sometime looking in config files to see where this 10 hours is coming from but to no avail.

I then decomipled the SharePoint assembly to see where it is reading the 10 hours setting from.

after tracing the calls I found out that it is hardcoded to 10 hours in the Assembly

Check below (decomplied code)

public virtual SecurityToken GetTokenFromResponse(RequestSecurityToken request, RequestSecurityTokenResponse response)
    DateTime? nullable;
    DateTime? expires;
    if (response != null)
        if (response.IsFinal)
            if (response.RequestedSecurityToken != null)
                SecurityToken securityToken = response.RequestedSecurityToken.SecurityToken;
                if (securityToken != null)
                    return securityToken;
                    if (response.RequestedSecurityToken.SecurityTokenXml != null)
                        SecurityToken proofKey = WSTrustChannel.GetProofKey(request, response);
                        if (response.Lifetime == null)
                            nullable = new DateTime?(DateTime.UtcNow);
                            DateTime utcNow = DateTime.UtcNow;
                            expires = new DateTime?(utcNow.AddHours(10));

1 Answer 1


Do the following powershell command:

$sts = Get-SPSecurityTokenServiceConfig
$sts.FormsTokenLifeTime = (New-TimeSpan -minutes 30)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.