title: Does XmlHTTPRequest/AJAX request on Asp.net MVC controller update session timeout
body: <h2>Scenario</h2>
  
  <p>We have an auto logout feature which activates a timeout window after 4 minutes or so. The timeout value is retrieved from the FormsAuthentication element of the Authentication configuration in the web.config file. E.g.:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/Login" timeout="5" /&gt;
  &lt;/authentication&gt;  
  </code></pre>
  
  <p>The JavaScript code simply has a timer which fires every second checking to see if: </p>
  
  <ol>
  <li>There's been no activity from the user (mouse clicks or mouse move) and,</li>
  <li>If there hasn't, checks to see if 5 minutes (or rather 4 minutes 30 seconds) has elapsed. If it has then,</li>
  <li>It shows a popup counting down from 30 seconds which lets the user either click continue to stop the auto logout or if left untouched automatically logs the user out and redirects them back to the login page. </li>
  </ol>
  
  <p>Here's an example of the code that runs on the client side to extend the session: </p>
  
  <pre><code>$.ajax({
      type: "GET",
      url: alchemy.rootPath + "Account/TimeOutExtend"
  });
  </code></pre>
  
  <p>The controller action being called does nothing: </p>
  
  <pre><code>public ActionResult TimeOutExtend()
  {
      return (ViewBag.None);
  }
  </code></pre>
  
  <h2>The Problem</h2>
  
  <p>At the moment when we leave the popup to run down to about 5 seconds and then click the button to continue the session, the user is logged out anyway.<br>
  This seems to come from the server's side rather than anything on the client side. </p>
  
  <h2>Question</h2>
  
  <p>Is it possible the XmlHTTPRequest AJAX requests to the MVC controller, currently used to extend the user's session, are in fact not extending the session because somehow MVC is treating the Ajax request differently? </p>