title: What sets System.Security.Principal.Identity.IsAuthenticated after Session timeout?
body: <p>I am currently adding an action filter to handle session timeout in our site:</p>
  
  <pre><code>[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
  public class SsoExpireFilterAttribute : ActionFilterAttribute
  {
      public override void OnActionExecuting(ActionExecutingContext filterContext)
      {
          if(!(filterContext.Controller.GetType() == typeof(HomeController) 
              &amp;&amp; filterContext.ActionDescriptor.ActionName == MVC.Home.ActionNames.Index))
          {
              if(filterContext.ActionDescriptor.ActionName != MVC.Home.ActionNames.TimeoutRedirect.ToLower())
              {
                  if (!Thread.CurrentPrincipal.Identity.IsAuthenticated)
                  {
                      if (filterContext.HttpContext.Request.IsAjaxRequest())
                          filterContext.Result = new JsonResult { Data = "_Logon_" };
                      else
                          filterContext.Result = new RedirectToRouteResult(
                              new RouteValueDictionary
                          {
                              {"Controller", "Home"},
                              {"Action", "TimeoutRedirect"}
                          });
                  }
              }
          }
  
          base.OnActionExecuting(filterContext);
      }
  }
  </code></pre>
  
  <p>I am expecting the IsAuthenticated flag on Principal.Identity to be false following timeout, however it is remaining true when it is hit in the action filter. (I know the session has timed out as I have put a break point on the Session_End in Global.asax and this is hit first).</p>
  
  <p>The authentication for our site is handled by a company standard "Single Sign On" dll, so I'm guessing that this is setting a separate authentication timeout, does this sound likely?</p>
  
  <p>Any help is appreciated.</p>