When I log in, in my surfacecontroller:

if (Members.Login(model.Username, model.Password))
{
    SetCookie(model.Username, model.RememberMe);
    return Redirect("/member-site");
}

And my method:

private void SetCookie(string userName, bool createPersistentCookie)
{
    int timeout = createPersistentCookie ? 525600 : 120; // Timeout in minutes, 525600 = 365 days.
    FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(userName, createPersistentCookie, timeout);
    string encrypted = FormsAuthentication.Encrypt(ticket);
    HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted);
    cookie.Expires = System.DateTime.Now.AddMinutes(timeout);

    Response.Cookies.Add(cookie);
    FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);
}

I will not be logged in for a year as planned - the cookie isn't persistent. Someone who sees the reason for the error?

I have added domain in web.config, and it worked:

<authentication mode="Forms">
  <forms name="myMemberAuthCookie" loginUrl="logg-inn" domain="mydomain.no" protection="All" path="/" />
</authentication>    

My method (createPersistentCookie is true/false from my "remember me" checkbox):

int timeout = createPersistentCookie ? 525600 : 120; // Timeout in minutes, 525600 = 365 days.
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
        userName,
        DateTime.Now,
        DateTime.Now.AddMinutes(timeout),
        createPersistentCookie,
        string.Empty,
        FormsAuthentication.FormsCookiePath);

string encrypted = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted); //FormsAuthentication.FormsCookieName: cookie.Name = "myMemberAuthCookie";
Response.Cookies.Add(cookie);
FormsAuthentication.SetAuthCookie(userName, createPersistentCookie, FormsAuthentication.FormsCookiePath);

But now I wonder how I can quit the cookie immediately upon logout. This isn't enough - cookie expiration is still active:

// clear authentication cookie
if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
    Response.Cookies[FormsAuthentication.FormsCookieName].Expires = DateTime.Now.AddDays(-30);

Session.Abandon();
FormsAuthentication.SignOut();
Members.Logout();

Are there errors in the code, or are there other settings I should set?

I can delete the cookie (when I log out)

HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted);

if I change the name from FormsAuthentication.FormsCookieName to Username

HttpCookie cookie = new HttpCookie(Username encrypted);

but then the timer expire in the cookie don't work at all, so how can I delete the cookie with the name FormsAuthentication.FormsCookieName instead of Username?

Should I use Javascript to delete the cookie?

In web.config you can set the timeout property for forms authentication, which configures how long the cookie is set for eg. for 30 days

<authentication mode="Forms">
  <!-- the timout period is how long (in minutes) the persistent cookie is set when "remember me" is checked (43200 mins = 30 days) -->
  <forms name="yourAuthCookie" loginUrl="/login/" protection="All" path="/" timeout="43200" />
</authentication>

Thanks, but I want two different times, for example one hour if member not have checked "Remember me" and 30 days if the member have checked "Remember me", and immediately logged out with a logout button, so in this case, web.config isn't enough?

Yes, it should be.

The timeout value is for the time set in the persistent cookie only for people who have ticked "remember me".

People who don't tick that will get a temporary session cookie. The timeout of that is governed by the sessionState timeout parameter in web.config eg. for 20 mins.

<sessionState timeout="20"></sessionState>

I've been thinking about that too, so I'll try a little, but I think I'll still have a challenge if a member presses "remember me" and after logged in press the button to eliminate the cookie immediately. Until now, User.Identity.IsAuthenticated has always been true, even after

Session.Abandon ();
FormsAuthentication.SignOut ();
Members.Logout ();

I'll keep trying, but I will still receive tips if you know this issue..

BTW: Whats the difference between

<sessionState timeout="20"></sessionState>    (sessionState is not in my web.config now)

and

<membership defaultProvider="UmbracoMembershipProvider" userIsOnlineTimeWindow="15">  ?

Session state is how long the session lasts (ie. how long an idle user who doesn't refresh his browser is logged in for).

userIsOnlineTimeWindow is used by providers to determine whether a member is online - it's basically when there last activity was plus a window. How this is determined is up to the provider. It has no bearing on log ins. Its more for calculating stuff like "how many users are currently using the app" etc.

https://msdn.microsoft.com/en-us/library/system.web.security.membership.userisonlinetimewindow.aspx

is working on a reply...