Increasing Login Timeout

The default DotNetNuke login timeout is 1 hour.

Extending the timeout of a DotNetNuke website can reduce how often you need to login to your website. It can also be used to limit the risk of losing data entered either in a form or the text/HTML module, when these have not been submitted.

The changes to the timeout are made in the web.config file. This is to be found at the root of the website. Depending upon how your DNN website is hosted you may not have access to this file. Changes to this file will affect all portals within the DotNetNuke instance.

Open an FTP session and download a copy of the web.config file. Open it using a plain text editor. Editors such as Word are likely to add additional code into the file.

Once you have opened the web.config file search for the line below

<authentication mode="Forms">
<forms name=".DOTNETNUKE" protection="All" timeout="60" cookieless="UseCookies" />
</authentication>

To increase the login period to 6 hours would be this:

<authentication mode="Forms">
<forms name=".DOTNETNUKE" protection="All" timeout="3600" cookieless="UseCookies" slidingExpiration="true" />
</authentication>

Other parameters can be included, the three most common entries are: Cookieless, SlidingExpiration and Protection. Details for these are given below:

Cookieless

It is better to set the parameter for this as UseCookies. This keeps the session details as a cookie. Otherwise it will be a part of the URL. If the session state is maintained in the URL its possible for the session to be hi-jacked by others. cookieless=”UseCookies”

SlidingExpiration

The slidingExpiration parameter is used to reset the timeout when a request is made (page submitted to the server) and over half of the timeout period has expired.
This is a recommended parameter to set since it reduces the risk of losing form data. slidingExpiration=”true”

Protection

Possible values include All, Encryption, Validation and None. All is chosen as this does both Encryption and Validation to ensure that the cookie values has not be modified. protection=”All”