Asp.Net Form认证滑动过期策略小问题

先不说别的,直接贴代码吧.

这个是在验证时候的代码:

View Code

1   if (FormsAuthentication.SlidingExpiration)
2                 {
3                     ticket = FormsAuthentication.RenewTicketIfOld(tOld);
4                 }

public static FormsAuthenticationTicket RenewTicketIfOld(FormsAuthenticationTicket tOld)
{
    if (tOld == null)
    {
        return null;
    }
    DateTime now = DateTime.Now;
    TimeSpan span = (TimeSpan) (now - tOld.IssueDate);
    TimeSpan span2 = (TimeSpan) (tOld.Expiration - now);
    if (span2 > span)
    {
        return tOld;
    }
    return new FormsAuthenticationTicket(tOld.Version, tOld.Name, now, now + (tOld.Expiration - tOld.IssueDate), tOld.IsPersistent, tOld.UserData, tOld.CookiePath);
}

 

 

如上面所示,对于滑动过期策略,会在有效期过了一半的时候,重新生成新的票据,那么,问题就来了,如果我开始登陆的时候,设置的有效期很长,比如480分钟,我登录了,但是现在因为别的原因,设置成了1分钟,那么,我仍然在这480分钟内是有效的? 虽然,这个好像无伤大雅,呵呵.

改成如下?

if (DateTime.Now.AddMinutes(FormsAuthentication.Timeout / 2) > tOld.Expiration)
{
   ticket = FormsAuthentication.RenewTicketIfOld(tOld);
}