My project has problem renewing Forms Authentication Session due to conflicting Forms Auth Cookies.
Detailed Description:
After a user logged in, one forms auth cookie (FACookieA) is created, and s/he is authenticated. When it comes to renew the cookie, however, a second forms auth cookie (FACookieB) is created, and FACookieA is not renewed. The User is redirected to login page
on page request after the expiration time in FACookieA, even it is before expiration time in FACookieB.
Generated cookies:
Please note that both cookies have the same name.
FACookieA:
name: FormsAuth domain: .formsauth.com
please note the "." pre-appended by .NET, the "formsauth.com" is from Forms Authentication Ticket section
FACookieB:
name: FormsAuth host: a.formsauth.com
please note the cookie uses "host", not domain, and "a.formsauth.com" is based on the current request url domain.
Project url tested:
a.formsauth.com
Web.config:
<forms loginUrl="~/Account/Login.aspx" name="FormsAuth"/>
Code
public partial class Account_Login : System.Web.UI.Page { protected void LoginButton_Click(object sender, EventArgs e) { if (Membership.ValidateUser(LoginUser.UserName.Trim(), LoginUser.Password.Trim())) { FormsAuthenticationTicket ticket = new FormsAuthenticationTicket( 1,"username", DateTime.Now, DateTime.Now.AddMinutes(2), false, string.Empty ); string encryptedTicket = FormsAuthentication.Encrypt(ticket); HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket); cookie.Domain = "formsauth.com"; cookie.Path = FormsAuthentication.FormsCookiePath; Response.Cookies.Remove(cookie.Name); Response.Cookies.Add(cookie); Response.Redirect("~/Account/ChangePassword.aspx"); //authenticated area }else { Response.Write("Invalid UserID and Password"); } } }
Questions:
1) How to generate one forms auth cookie, so that users can renew forms auth session and will not be logged out?
Considerations:
1) The project needs to support multiple languages, with possible domain formats below:
a.formsauth.com en.formsauth.com us.formsauth.com
or
a.formsauth.com a.en.formsauth.com a.us.formsauth.com
Any idea?