<p>I defined a Controller to force authentication by using the [Authorize] attribute. When a session times out, the request is still passed down and executed instead of forcing a redirect.</p>

<p>I do use FormsAuthentication to login and logoff users.</p>

<p>Any ideas on how to control that?</p>

<p>Example: </p>

<pre><code>[Authorize]
public class ProjectsController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
}
</code></pre>

To track user sessions ASP.NET uses the
ASP.NET_SessionId
cookie. To track authenticated users ASP.NET uses the
ASPXAUTH
cookie (by default).
When a session times out the
ASP.NET_SessionId
cookie might no longer be sent by the client but the
ASPXAUTH
cookie is still sent which might explain why your action is rendered.
To override default forms authentication values you might take a look
here
. I also suggest you to use the
firebug
extension to see exactly which cookies are sent by the client.