asp.net cookies, authentication and session timeouts

by

Avoid using session as much as you can, if you can get away without seesion it makes multi-server deployments qutie a bit easier. Probably, Name and email are easy candidates for cookies. It’s easy to fake a cookie, so userID may not be a good idea depending on your security needs.

The forms authentication cookies are encrypted and you can add extra data to those cookies (See details below). It’s probably hackable but not nearly as easily as a simple cookie.

Here is the code I have used in the past slightly modified to remove some project specific details. Call this in the LoggedIn event of the login control.

void AddUserIDToAuthCookie(string userID)  
{  
  //There is no way to directly set the userdata portion of a FormAuthenticationTicket  
  //without re-writing the login portion of the Login control  
  //  
  //I find it easier to pull the cookie that the Login control inserted out  
  //and create a new cookie with the userdata set  

  HttpCookie authCookie = Response.Cookies[AUTH_COOKIE];
  if(authCookie == null)
  {
    return;
  }

  Response.Cookies.Remove(AUTH_COOKIE);

  FormsAuthenticationTicket oldTicket = FormsAuthentication.Decrypt(authCookie.Value);
  var newTicket =
    new FormsAuthenticationTicket(oldTicket.Version, oldTicket.Name, oldTicket.IssueDate, oldTicket.Expiration,
                                  oldTicket.IsPersistent, userID, oldTicket.CookiePath);

  authCookie.Value = FormsAuthentication.Encrypt(newTicket);

  Response.Cookies.Add(authCookie);
}

FYI, I copied this from an old project and edited it here to remove some project specific bits, so it may not compile, but it’ll be very close.

To get the ID in your webpage…

FormsAuthenticationTicket ticket = ((FormsIdentity) Page.User.Identity).Ticket;
string id = ticket.UserData;

I used this mechanism to store an id that was not part of the aspnetdb user data. If all your identity data is handled by the aspnetdb, you may only need to access the Page.User.Identity object.

More Related Contents:

  1. Asp.Net Forms Authentication when using iPhone UIWebView
  2. Chrome localhost cookie not being set
  3. set cookie to expire at end of session? asp.net
  4. Cache VS Session VS cookies?
  5. Web authentication state – Session vs Cookie?
  6. ASP.NET Session Cookies – specifying the base domain
  7. How is HttpOnly get set for ASP.NET_SessionId cookie?
  8. Replacing ASP.Net’s session entirely
  9. What should I do if the current ASP.NET session is null?
  10. ASP.NET: Session.SessionID changes between requests
  11. Forms authentication timeout vs sessionState timeout
  12. Losing Session State
  13. Close/kill the session when the browser or tab is closed
  14. Adding ASP.NET MVC5 Identity Authentication to an existing project
  15. How do I protect static files with ASP.NET form authentication on IIS 7.5?
  16. How can I share a session across multiple subdomains in ASP.NET?
  17. Store/assign roles of authenticated users
  18. How can I create persistent cookies in ASP.NET?
  19. Preventing CSRF with the same-site cookie attribute
  20. ASP.NET session state provider in Azure [closed]
  21. Passing session data between ASP.NET Applications
  22. In ASP.NET, when should I use Session.Clear() rather than Session.Abandon()?
  23. ASP.NET Stress Testing
  24. ASP.net session request queuing
  25. ASP.NET MVC – Session is null
  26. Is there a browser equivalent to IE’s ClearAuthenticationCache?
  27. Asp.Net Session is null in ashx file
  28. ASP.NET Why are sessions timing out, sessionstate timeout set
  29. Too many cookies OpenIdConnect.nonce cause error page “Bad Request – Request Too Long”
  30. asp.net session variables on Session_End

Leave a Comment