Hi,
I have a website that uses Forms Authentication to secure the ~/Members/ folder. Nobody should be able to access this folder unless they log in.
This works fine on my development system, but after uploading it to a test server and setting up the website on IIS, the Forms Authentication fails. The login is successful, but asp.net redirects me back to the login screen with the ReturnUrl value in the
address bar. Login attempts that follow also fail in the same way.
My setup's a little more complex than I'm used to for forum posts, but I'll try to sum up.
Login.aspx.cs
protected void Page_Load(object sender, EventArgs e)
{
// handle log out
if (!String.IsNullOrEmpty(Request.Params["action"]) && Request.Params["action"] == "logout")
{
Session.Clear();
FormsAuthentication.SignOut();
FormsAuthentication.RedirectToLoginPage();
}
}
protected void btnLogin_Click(object sender, EventArgs e)
{
Page.Validate("Login");
if (!Page.IsValid)
{
return;
}
processLogin();
}
private void processLogin()
{
try
{
// LoginContext is a class wrote to handle login
// procedures and the creation of session variables
LoginContext log = new LoginContext();
log.SetUser(txtEmail.Text, txtPassword.Text);
if (log.DoLogin())
{
if (chkCookie.Checked)
{
HttpCookie cookie = createPersistantCookie(txtEmail.Text, 7);
Response.Cookies.Clear();
Response.Cookies.Add(cookie);
}
FormsAuthentication.SetAuthCookie(txtEmail.Text, true);
FormsAuthentication.RedirectFromLoginPage(txtEmail.Text, true);
Response.Redirect("~/Members/Default.aspx");
}
}
catch (Exception ex)
{
lblerr.Text = ex.ToString();
}
}
private HttpCookie createPersistantCookie(string Username, int PersistDays = 0)
{
HttpCookie cookie = new HttpCookie("stman");
if (PersistDays != 0)
{
cookie.Expires = DateTime.Now.AddDays(PersistDays);
}
cookie["user"] = Username;
return cookie;
}The user supplies an email address and password to log in with. That information is then sent via the LoginContext class to the database. If the database returns a row (the credentials are used in a SELECT command), then the login is successful and the user should be authenticated.
Members/Members.master.cs
protected void OnPreInit(EventArgs e)
{
base.Init += new EventHandler(Page_Init);
}
protected void Page_Init(object sender, EventArgs e)
{
if (HttpContext.Current.User.Identity.IsAuthenticated)
{
// the user is still authenticated, but the session expired
// process the login again with the authenticated user data
// to re-create the session variables
if (Session["userid"] == null)
{
LoginContext log = new LoginContext();
log.DoLogin(HttpContext.Current.User.Identity.Name);
}
}
else
{
FormsAuthentication.SignOut();
Response.Redirect("~/Login.aspx");
}
}
protected void Page_Load(object sender, EventArgs e)
{
if (!IsPostBack)
{
// handles some presentation updates specific to the logged in user
}
}The Page_Init() method here monitors the user state. If the session has expired, but the user is still authenticated, it should create a new session for the user. If the authentication cookie has expired, the user needs to log in again.
web.config
<configuration><system.web><compilation debug="true" targetFramework="4.5" /><httpRuntime targetFramework="4.5" /><authentication mode="Forms"><forms name="STMan" loginUrl="~/Login.aspx" path="/Members"
slidingExpiration="true" timeout="30"></forms></authentication><authorization><allow users="?"/></authorization></system.web><location path="Members"><system.web><authorization><deny users="?"/><allow users="*"/></authorization></system.web></location></configuration>
I wrote this XML for the web.config file in a test site to see whether or not I understood the concept correctly. This test site works perfectly from the code above, but the site that I'm working on now, doesn't.
To make things clearer (hopefully), here's a link to a zip file I made with the relevant files:
http://www.loganyoung.za.net/stman.zip
Basically what I need to know is:
- What would cause Forms Authentication to fail to authenticate (any and all possibilities)?
- Is there anything I've done wrong in my code?
- How could I do this better to achieve the results I'm looking for every time (as it seems I have a different problem with the same symptoms every time I do this)?
Thanks in advance for your help!