Forms Authentication understanding context.user.identity

by

The way your code is written logins will persist across browser sessions. It might help to understand the basics of what is going on.

For cookie based authentication methods, there are really three actions:

1) Login – validates user’s credentials and creates and stores a cookie on their browser.

2) Logout – simply removes the cookie from the browser (by expiring the cookie or deleting it)

3) Per Request Validation (the part that is is your Application_AuthenticateRequest) – check to see if a cookie exists, and if so, get the user’s Identity and Roles and set HttpContext.Current.User.

Typically, the FormsAuthentication module hides most of this from you. It looks like your code is trying to use some of the elements of FormAuthentication (like the FormsAuthenticationTicket and FormsIdentity. This is fine as long as you get what you want.

Your Login_Authenticate method looks fine EXCEPT you are setting an expiration on the cookie. This will make the cookie persist even if you close and reopen the browser. Since this is not the behavior you want, I would not set a cookie expiration. Setting this is like checking the “remember me” checkbox.

The code in Application_AuthenticateRequest gets run every time a page is served from your application. It’s primary job is to set HttpContext.Current.User. Typically, if no user is logged in, User is either null or an Anonymous user. If a user is logged in, this should represent your user.

If you are doing these three things, then anywhere in your code you can reference HttpContext.Current.User to decide what level of information you want to display. For instance, if you want to restrict a page to administrators only, you could call HttpContext.Current.Users.IsInRole(“Administrators”), and redirect them away from the page if the call returns false.

Hope this helps.

More Related Contents:

  1. Forms Authentication across Sub-Domains
  2. How can I handle forms authentication timeout exceptions in ASP.NET?
  3. Storing more information using FormsAuthentication.SetAuthCookie
  4. AuthenticateRequest event
  5. How to display words that appear more than 'x' times in a text? [closed]
  6. how to get Value that cause exception
  7. Annual calender in asp.net page [closed]
  8. How do I run this code
  9. Can I automatically increment the file build version when using Visual Studio?
  10. Create an array or List of all dates between two dates [duplicate]
  11. How to write a simple Html.DropDownListFor()?
  12. ASP.NET MVC 5 group of radio buttons
  13. An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode
  14. How do I connect to an .mdf (Microsoft SQL Server Database File) in a simple web project?
  15. Web.Config Debug/Release
  16. Mock static property with moq
  17. ASP.Net MVC route to catch all *.aspx requests
  18. “The LINQ expression node type ‘Invoke’ is not supported in LINQ to Entities” – stumped!
  19. how to find control in edit item template?
  20. Do I have to Close() a SQLConnection before it gets disposed?
  21. Can “EndResponse” increase performance of ASP.Net page
  22. Convert a string’s character encoding from windows-1252 to utf-8
  23. pass jquery json into asp.net httphandler
  24. HttpWebRequests sends parameterless URI in Authorization header
  25. Get the current user, within an ApiController action, without passing the userID as a parameter
  26. When Should I Use Response.Redirect(url, true)?
  27. Could not load file or assembly ‘System.Web.Helpers, error on IIS 8
  28. WebAPI Request Streaming support
  29. Conditional Logic in ASP.net page
  30. Cast an Anonymous Types in Object and retrieve one Field

Leave a Comment