Why is my ASP.NET MVC persistent auth cookie not working?

Question

I'm using ASP.NET MVC 3, with forms authentication (based on modified vanilla account code you get with file->new).

When you login, I am setting an auth cookie with

FormsAuthentication.SetAuthCookie(userName, true);

So this should set a persistent cookie. But if I close the browser and re-open, when I browse to the site I am forced to log in again! I can see using chrome dev tools that the cookie (.ASPXAUTH) is being created and not being deleted when I close the browser, so what's happening?

My web.config:

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogIn" timeout="10000"/>
</authentication>

I'm testing this locally, under IIS if that makes any difference.

you can check this answer: stackoverflow.com/questions/682788/… — alexl
– alexl, Commented Jan 13, 2012 at 14:51
Ok, this link seemed to sort it for me - sticking with SetAuthCookie and tweaking my config to explicitly set the cookie name (in the web.confg), and all is working now. Weird! — Matt Roberts
– Matt Roberts, Commented Jan 13, 2012 at 15:20
@Matt Roberts - I have no idea why but setting the cookie name fixed it for me too. You'd think it'd just work with the cookie being domain specific etc. Is this a bug in MVC or .NET maybe? — Greg
– Greg, Commented May 4, 2012 at 22:38

Tomasz Jaskuλa · Accepted Answer · 2012-01-13 15:05:45Z

10

I'd better create myself a cookie using authentication ticket. SetAuthCookie creates an auth ticket under the hood. Have you tried making your own auth ticket? It will let you store extra data on it.

Here's an example :

// create encryption cookie         
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(1, 
        userName, 
        DateTime.Now,
        DateTime.Now.AddDays(90),
        createPersistentCookie, 
        string.Empty);

// add cookie to response stream         
string encryptedTicket = FormsAuthentication.Encrypt(authTicket);    
System.Web.HttpCookie authCookie = new System.Web.HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
if (authTicket.IsPersistent) 
{     
      authCookie.Expires = authTicket.Expiration; 
}
System.Web.HttpContext.Current.Response.Cookies.Add(authCookie);

Hope this helps.

edited Jan 13, 2012 at 15:05

answered Jan 13, 2012 at 14:45

Tomasz Jaskuλa

16.1k5 gold badges49 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Matt Roberts Over a year ago

Thanks. So I shouldn't use SetAuthCookie at all? The MSDN documentation tells me to use that to create an auth cookie which can be persistent. Also, the vanilla code for a new MVC app uses SetAuthCookie - is that wrong?

Tomasz Jaskuλa Over a year ago

SetAuthCookie() is doing globally the same. It's just weird because it seems it doesn't work all the time. I prefer to create myslef an authentication ticket and add it to the response stream.

Tomasz Jaskuλa Over a year ago

check also the link @alexl posted as a comment to your question.

Matt Roberts Over a year ago

Seem to have it working now (see comment on question), using SetAuthCookie. Thanks.

Community · Accepted Answer · 2017-05-23 12:09:42Z

4

Solved from comment from @alexl:

you can check this answer: Making user login persistant with ASP .Net Membership

Ok, this link seemed to sort it for me - sticking with SetAuthCookie and tweaking my config to explicitly set the cookie name (in the web.confg), and all is working now. Weird! –

edited May 23, 2017 at 12:09

CommunityBot

11 silver badge

answered Jan 17, 2013 at 12:29

Matt Roberts

26.9k31 gold badges111 silver badges182 bronze badges

Collectives™ on Stack Overflow

Why is my ASP.NET MVC persistent auth cookie not working?

2 Answers 2

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related