Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

Forms Authentication Renewal Issue with Custom Forms Authentication

$
0
0

My project has problem renewing Forms Authentication Session due to conflicting Forms Auth Cookies.

Detailed Description:

After a user logged in, one forms auth cookie (FACookieA) is created, and s/he is authenticated. When it comes to renew the cookie, however, a second forms auth cookie (FACookieB) is created, and FACookieA is not renewed. The User is redirected to login page on page request after the expiration time in FACookieA, even it is before expiration time in FACookieB.
 
Generated cookies:

Please note that both cookies have the same name.

FACookieA:

    name: FormsAuth
    domain: .formsauth.com

please note the "." pre-appended by .NET, the "formsauth.com" is from Forms Authentication Ticket section

FACookieB:

    name: FormsAuth
    host: a.formsauth.com

please note the cookie uses "host", not domain, and "a.formsauth.com" is based on the current request url domain.

Project url tested: 

a.formsauth.com

Web.config:

<forms loginUrl="~/Account/Login.aspx" name="FormsAuth"/>


Code

 public partial class Account_Login : System.Web.UI.Page
    {   
        protected void LoginButton_Click(object sender, EventArgs e)
        {
            if (Membership.ValidateUser(LoginUser.UserName.Trim(), LoginUser.Password.Trim()))
            {
                FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                     1,"username",
                  DateTime.Now,
                  DateTime.Now.AddMinutes(2),
                  false,
                  string.Empty
                  );
                string encryptedTicket = FormsAuthentication.Encrypt(ticket);
                HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
                cookie.Domain = "formsauth.com";
                cookie.Path = FormsAuthentication.FormsCookiePath;
                Response.Cookies.Remove(cookie.Name);
                Response.Cookies.Add(cookie);
                Response.Redirect("~/Account/ChangePassword.aspx"); //authenticated area
            }else
            {
                Response.Write("Invalid UserID and Password");
            }
        }
    }


Questions:

1) How to generate one forms auth cookie, so that users can renew forms auth session and will not be logged out?

Considerations:

1) The project needs to support multiple languages, with possible domain formats below:

    a.formsauth.com
    en.formsauth.com
    us.formsauth.com

or

    a.formsauth.com
    a.en.formsauth.com
    a.us.formsauth.com

Any idea?


Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>