asp.net - .ASPXROLES membership roles cookie expiry -

using asp.net 2.0, forms authentication. test, configured roles cookie in web.config :

<rolemanager enabled="true" cacherolesincookie="true" cookiename=".aspxroles" cookietimeout="2"></rolemanager> 

i wanted see happen when cached role cookie expired. using fiddler, after 2 minutes had elapsed, see raw value of role cookie had changed.

i expecting on expiry, asp.net re-read roles information database, , repopulate cookie same value. question is, why raw value of cookie change after expiry ? cookie value not human-readable (base 64 encoded and/or encrypted ?), can't tell if information in same, although application still seems work fine.

edit :

it looks each time roles encrypted , cached in cookie, gets different raw value.

e.g. if run following code :

    roleprincipal rp = (roleprincipal) user;     string str = rp.toencryptedticket();     label1.text = str; 

you different value each time. behavior seems normal.

well aspxroles cookie pertains role queries on user. unless you're doing things roles cause function differently (web.config auth?) you're not going see expiring cookie.

can share web.config , basic pages you're using test this?

have tried particular configuration see changes after expiration?

<location path="img/logo.png">     <system.web>         <authorization>             <deny users="?"/>             <allow roles="canseelogo"/>         </authorization>     </system.web> </location> 

---

based on question edit:

in web.config under <configuration><system.web> have key:

<machinekey decryption="aes" decryptionkey="{64bits random hex}" validation="sha1" validationkey="{128 bits random hex}"/> 

i'm curious if set "manually" if you'll have changing encrypted string. also, set default in c:\windows\microsoft.net\framework\etc folders, can redefine (obviously) in web.config override per application. allows share same cookie cross-app within domain.

link generate random hex strings

https://www.grc.com/passwords.htm

concat first result 2 page refreshes second one. removing web.config key later doesn't impact app negatively (of course wouldn't)