Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

authorization broke

$
0
0

                           My users additional information data is contained in a table called riders. That table has a rider ID and it is assigned the  UserId  (unique identifier) that the user received when the user was created. Once logged in I set the authTicket.User Data = to the  riderid. This appears to work and the  debugger shows the authTicket.User Data = to the  riderid. Now that user clicks on "My Profile"  which is where they can  update a variety of items. They must be authenticated to enter and must have  their riderid to retrieve their info. They pass the isAuthenticated line but when the UserData is requested it errors.  "

Input string was not in a correct format." and it is true - UserData is now '/'

This code worked a few days ago, and I have not changed it. Does anyone see why it would change?

if (Membership.ValidateUser(userName.Text, Password.Text) == true)
        {
            CheckBox rememberMe = (CheckBox)Login1.FindControl("RememberMe");

            bool PersistMe = rememberMe.Checked;

            rider bd = new rider();

            string UserData = bd.getRidFromUsername(uname).ToString();
            
            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, uname, DateTime.Now, DateTime.Now.AddMonths(3), false, FormsAuthentication.FormsCookiePath);
            string encryptedTicket = FormsAuthentication.Encrypt(ticket);
            HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
            if (PersistMe == true)
                authCookie.Expires = DateTime.Now.AddMonths(3);//make sure its same as the formsauthentication ticket expiry value
            else
            {
                authCookie.Expires = DateTime.Now.AddMinutes(5);
            }
            Response.Cookies.Add(authCookie);
            rider rd = new rider();
            int albumid = 0;
            if( ! rd.albumexists(Convert.ToInt32(UserData),"Profile" , 1 ))
                rd.createalbum(Convert.ToInt32(UserData), "Profile", 1, albumid);
            ///Response.Redirect("~/Account/confirmedvalidation.aspx");
            Response.Redirect("~/Main/Home.aspx");
        }
    }

This is the login code that sets the userdata to the riders number

  if (User.Identity.IsAuthenticated)
        {
            HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
            if (authCookie != null)
            {
                FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
                rid = Convert.ToInt32(authTicket.UserData);

The last line in this code is where it breaks.


Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>