Well I'm working on a WebApplication using FormsAuthentication.FormsCookieName. I have this in the WebConfig:
<httpCookies requireSSL="true" />
<authentication mode="Forms">
<forms cookieless="UseCookies"
name=".ASPXAUTH1" />
</authentication>
in code:
var httpCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(ticket))
{
HttpOnly = true,
Domain = "." +host, // Ex- host = google.com (without www because we use subdomains)
Secure = false
};
httpCookie.Expires = remember ? DateTime.Now.Add(FormsAuthentication.Timeout) : DateTime.Now.AddMinutes(1);
When I log in to the web app everything looks good:
the domain with the red arrow = .google.com
after a few seconds the second cookie appears with a different domain = www.google.com and Expires Date
I'm not using the RedirectToLoging Page Method.
this was solved adding slidingExpiration property in webconfig
<authentication mode="Forms" >
<forms cookieless="UseCookies" name=".ASPXAUTH" slidingExpiration="false" />
Related
I'm converting my current MVC application which uses windows based authentication to forms based. I have made changes in web.config and global.asax file. Now when I run the application, it goes to login page and with the user's credentials validated, its gets navigated to other page. My issue is when I do a signout, my applicationhost.config file gets rewrited from
<windowsAuthentication enabled="false" />
to
<windowsAuthentication enabled="true" />
and then if I hit the home page of my application, it takes my windows credentials.
In my web config I do have
<authentication mode="Forms">
<forms loginUrl="~/Logon/Index"></forms>
</authentication>
<authorization>
<deny users="?" />
</authorization>
In global.asax I have
string username = FormsAuthentication.Decrypt(Request.Cookies[FormsAuthentication.FormsCookieName].Value).Name;
string roles = string.Empty;
//Let us set the Pricipal with our user specific details
HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(
new System.Security.Principal.GenericIdentity(username, "Forms"), roles.Split(';'));
ISecurityUserIdentity objUser = null;
objUser = SecurityLibrary.Security.GetUser(username, Mgr.GetSecurityAttribute());
Context.User = objUser;
My issue is why my applicationhost.config file rewrites automatically when I do a signout and change my authentication mode.
I am trying to setup my website on a new environment, and I have a problem with the membership provider.
I can call Membership.ValidateUser, which returns true and false, as it should. That is perfect.
However, on my new environment, the cookie is never set. I can see on localhost and our production server, that it sets a cookie called CommunityServer, but not on our new environment.
Web.config code:
<authentication mode="Forms">
<!-- development -->
<forms name=".CommunityServer" protection="All" timeout="60000" loginUrl="~/user/login" slidingExpiration="true"/>
<!-- deployment -->
<!--<forms name=".CommunityServer" domain="domain.com" protection="All" timeout="60000" loginUrl="~/user1.aspx" slidingExpiration="true" />-->
</authentication>
<authorization>
<allow users="?"/>
</authorization>
Log in code:
if (String.IsNullOrEmpty(UsernameLogin)) {
ModelState.AddModelError("UsernameLogin", Strings.Error_NoLoginUsernameEntered);
}
if (String.IsNullOrEmpty(PasswordLogin)) {
ModelState.AddModelError("PasswordLogin", Strings.Error_NoLoginPasswordEntered);
}
if (!Membership.ValidateUser(UsernameLogin, PasswordLogin)) {
ModelState.AddModelError("UsernameLogin", Strings.Error_LoginFailed);
}
if (!ModelState.IsValid) {
return View(new UserLoginModel() { Title = String.Format(Strings.Site_Title, Strings.UserLogin_Title) });
}
FormsAuthentication.SetAuthCookie(UsernameLogin, true);
// we know this code is run and I am being redirected to the return url
if (!String.IsNullOrEmpty(ReturnUrl)) {
return Redirect(ReturnUrl);
}
Any ideas of hints about why our cookie is never set? It is an IIS 8 server.
Add the domain="domain.com" on the parametre of authentication, to say to the cookie to be valid to the full domain, and to the correct domain, or else there is the possibility to not been able to be set.
<authentication mode="Forms">
<!-- development -->
<forms name=".CommunityServer" domain="domain.com" protection="All" timeout="60000" loginUrl="~/user/login" slidingExpiration="true"/>
I am facing a problem,
I have set session time out in web.config
<system.web>
<sessionState timeout="60" mode="InProc" />
<httpRuntime targetFramework="4.5" />
<compilation debug="true" targetFramework="4.5" />
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>
</system.web>
In my controller
public ActionResult CreateBrand()
{
Session.Timeout=60;
Purchase purchase = Session["purchaseItem"] as Purchase;
if (purchase!=null && purchase.Brand != null)
{
return View(purchase.Brand);
}
return View();
}
You never actually ask a question, so I'll take a stab at guessing what you're asking...
<sessionState timeout="60" mode="InProc" />
When mode="InProc", setting timeout="60" usually does not extend the session timeout beyond 20 minutes because the application pool will spin down (by default) after 20 minutes.
No application pool = no process = no session.
Either change your application pool settings or use a different session state provider.
I am trying to use FormsAuthentication.RedirectFromLoginPage(username,true,cookiepath);
On using FormsAuthentication.RedirectFromLoginPage it's redirecting to the DefaultUrl provided in the web.config.
Authentication section in web.config:
<authentication mode="Forms">
<forms name=".ASPXADMINAUTH"
loginUrl="/Default.aspx"
defaultUrl="homepage.aspx"
protection="All"
timeout="30" path="/admin" slidingExpiration="true" enableCrossAppRedirects="false" cookieless="UseCookies" domain="localhost" ticketCompatibilityMode="Framework20" ></forms>
</authentication>
In httpModules Section:
<add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />
The page is redirecting from the Loginpage to the "homepage.aspx" but it didn't set the Authentication cookie.
In my Response header, Set-Cookie contains the Authentication cookie, but it is not set in the homepage.aspx page.
So the LoginStaus and LoginName control is not working.
The problems in your code are path="/admin" domain="localhost"
According to your code
After user logins, a cookie is set under /admin. As the result, every pages under /admin folder knows that the user is authenticated such as ~/admin/default.aspx.
However ~/homepage.aspx does not know about user, because ~/homepage.aspx cannot read cookie written under /admin.
var path = FormsAuthentication.FormsCookiePath;
FormsAuthentication.RedirectFromLoginPage("win", false, path);
How to fix it?
You want to start slowly using simple one. Then tweak depending on what you need.
<forms loginUrl="~/Default.aspx" timeout="2880" defaultUrl="~/homepage.aspx" />
FYI: Please do not add properties which are default such as slidingExpiration="true",
enableCrossAppRedirects="false" and so on.
My site will have a few tools/sub-sites available for people to do different things. I have one common Login UserControl that will be used so I am not really duplicating much. But each of these sub-sites have their own MasterPage and thus styling. There is only one User table in the database and there are Roles for which sub-site you can get to. The Login UserControl will handle that.
Here is a simplized folder structure:
\Root
--> Images
--> Scripts
--> Styles
--> POHR
------> Login.aspx
------> PORHMasterPage
--> Beer
------> Login.aspx
------> BeerMasterPage
--> StatusUpdates
------> Login.aspx
------> StatusUpdatesMasterPage
Each of those Login Pages use the same Login UserControl which validates people and sets up a Cookie as see here:
public void LogUserIn(string EMailOrName, string Password) {
DS.User u = DS.Common.ValidateUser(EMailOrName, Password);
if (u != null) {
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
1,
u.FirstName + " " + u.LastName,
DateTime.UtcNow,
DateTime.UtcNow.AddMinutes(30),
true,
string.Format("UserID={0}|SiteID={1}", u.ID, SiteID)
);
string eTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, eTicket);
Response.Cookies.Add(cookie);
string redirectUrl = FormsAuthentication.GetRedirectUrl(EMailOrName, true);
Response.Redirect(redirectUrl);
} // if they got authenticated
} // LogUserIn - Method
My issue is the FormsAuthentication.GetRedirectUrl. It is returning /default.aspx. I tried adding the following to the Web.config
<location path="~/StatusUpdates">
<system.web>
<authentication mode="Forms">
<forms loginUrl="~/StatusUpdates/Login.aspx" defaultUrl="~/StatusUpdates/Dashboard.aspx" timeout="30" slidingExpiration="false" name="MGG_StatusUpdates" />
</authentication>
</system.web>
</location>
<location path="~/Beer">
<system.web>
<authentication mode="Forms">
<forms loginUrl="~/Beer/Login.aspx" defaultUrl="~/Beer/Dashboard.aspx" timeout="30" slidingExpiration="false" name="MGG_Beer" />
</authentication>
</system.web>
</location>
I would expect a page the above defaultUrl values to be passed back based on where I am in the application.
My questions are... How can I get this to do what I want? Do I need Web.config files in each of those folders, if so, what should they hold as well as what should the root's web.config file have.