Problem with ASP.NET Authentication

Question

I'm having problem with our login procedure.

Some customers complain that they can't login. I can see in our logs that their login is successful and that they are redirected from the login page to the member area. But there somehow the login isn't detected and they are bounced back to the login page.

I've asked customers to check if cookies are supported (http://www.html-kit.com/tools/cookietester/) but problem remains even if this test returns true.

This is how I've implemented the login procedure (simplyfied):

protected void Login(string email, string password)
{

FormsAuthentication.SignOut();


Guid clientId = /* Validate login by checking email and password, if fails display error otherwise get client id */


FormsAuthentication.SetAuthCookie(clientId.ToString(), true);

HttpContext.Current.Response.Redirect("~/Members.aspx");


}

On the member page I check for authentication by in Page_Load function:

public static void IsAuthenticated()
{
 if (!HttpContext.Current.User.Identity.IsAuthenticated)
 {
         HttpContext.Current.Response.Redirect("~/Login.aspx", true);
 }
}

Maybe I'm using FormsAuthentication completely wrong?

I've asked this before but still haven't been able to figure this out, I'd appreciate any help.

From my Web.Config:

<system.web>
    <compilation debug="false">
      <assemblies>
       ...
      </assemblies>
    </compilation>
    <authentication mode="Forms"/>
    <sessionState mode="InProc" cookieless="false" timeout="180"/>
    <customErrors mode="On"/>
    <httpHandlers>
    ...
    </httpHandlers>
    <httpModules>
    ...
    </httpModules>   </system.web>

you miss the loginpage and the deny all users (see my answer). — Michel
– Michel, Commented Jun 3, 2010 at 9:03
Note that the current login procedure work for most customers (99%). — Niels Bosma
– Niels Bosma, Commented Jun 3, 2010 at 9:19

Michel · Accepted Answer · 2010-06-03 08:48:16Z

2

public static void IsAuthenticated() { if (!HttpContext.Current.User.Identity.IsAuthenticated) { HttpContext.Current.Response.Redirect("~/Login.aspx", true); } }

is not necessary when you use forms authentication.

When you specify the forms authentication in the web.config (in which you also specify the login page)

<authentication mode="Forms">
  <forms loginUrl="/Authorization/Login" timeout="60" />
</authentication>

and you deny all non-athenticated users access

<authorization>
          <deny users="?" />
      </authorization>

you don't have to check the authentication of a user yourself, the framework takes care of that.

I would place the FormsAuthentication.SignOut(); code behind a 'logout' link

answered Jun 3, 2010 at 8:48

Michel

23.7k50 gold badges161 silver badges256 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Niels Bosma Over a year ago

As I have a bit weird requirements I can't use traditional ASP.NET authentication... I'm stuck with using SetCookieAuth and Identity.IsAuthenticated.

this. __curious_geek · Accepted Answer · 2010-06-03 08:38:34Z

1

Seperate the call of SignOut() and SetAuthCookie() in different methods. You may call FormsAuthentication.SignOut(); when the Login page loads first time - simply just do away from calling SignOut() on Login page. And Call FormsAuthentication.SetAuthCookie(clientId.ToString(), true); after authentication is successful.

answered Jun 3, 2010 at 8:38

this. __curious_geek

43.2k22 gold badges117 silver badges137 bronze badges

1 Comment

Niels Bosma Over a year ago

Tried this but it didn't have any effect :(

Thorarin · Accepted Answer · 2010-06-03 08:54:24Z

1

Normally you would use FormsAuthentication.Authenticate together with some membership provider, but this should work, and it actually does in my machine.

Are you removing the FormsAuthentication from your registered HTTP modules? Normally, this is in the machine wide web.config:

<configuration>
  <system.web>
    <httpModules>
      <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule"  />
    </httpModules>
  </system.web>
</configuration>

If you put a <clear /> inside that same section of your own web.config, you're effectively removing that module.

My tested Web.config is pretty clean, it only has <authentication mode="Forms"/> configured.

answered Jun 3, 2010 at 8:54

Thorarin

48.7k12 gold badges77 silver badges111 bronze badges

2 Comments

Niels Bosma Over a year ago

No I haven't removed it. Note that the problem is not affecting everyone.

Niels Bosma Over a year ago

How do you perform your login?

Collectives™ on Stack Overflow

Problem with ASP.NET Authentication

3 Answers 3

1 Comment

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related