I have a asp.net application where i am using FormAuthentication Ticket when user Sign in....on each page I want to check if FormAuthentication Ticket has expired ...how to do this ?..
View 6 RepliesI am developing a asp.net application using SQLServer 2008 and I have a page "Default.aspx" in which i have userID and Password textboxes and a SUBMIT button. Here is the script I am using to authenticate.
[Code]....
Well now i want to know that by using FormAuthenticationTicket how can I check on other pages if user is authenticated user cause in the URL if i just change the page like "Main.aspx" and hit it takes me there which should not happen and redirected to Login page.
How should i check on every page on page load event if user is authenticated or not and if not then redirected to Login.aspx.
How server will detect the specific user, by the formsAuthentication cookie.
View 3 RepliesI have a web app that uses window.openModalDialog to display a page. This page has a hyperlink that connects to an HttpHandler to retrieve a file. The link has a target property of "_blank". We've recently implemented Forms Authentication on this site in place of a flaky proprietary solution and we are noticing that now whenever we click on that link we get a pop-up window and the login screen appears.In the authorization section of the web.config we're saying that we don't want to allow anonymous. However, if I add a location element with the URL the handler is associated with, I can hit the breakpoint in the ProcessRequest method because it doesn't care if I'm not logged in. What's odd is that I should be logged in so it seems that the authentication ticket (which isn't expired yet) isn't being accepted in the popup window. If I allow anonymous I can bypass this problem, however the code that retieves the file relies on Session data and it's null. Therefore, either way I can't get this to work.It has been suggested that instead of a modal dialog just use window.open, however I'm reluctant to do that because when this window is open I don't want users accessing the parent window due to several reasons. Is there any way to get around this problem? I don't want to ditch forms auth for the old way because it wasn't secure.
View 1 RepliesI am not sure if I am asking this question correctly. Sometimes when you don't know enough, you may not know what to ask. I want to set up memberships with an ASP.NET website. The memberships will have a 14 day free trial period. After that, the user will need to pay a fee if they wish to continue to access the website. I am not sure how to accomplish this. After adding a membership database to the website, setting up roles ect., what do I do next? Do I need to make adjustments to the tables of the database, or write some code somewhere in the application? I have never done this exercise before, Logically, I know that I need to implement something that keeps track of expiration date. Also, how do I prevent a user from just making up new user names and credentialing?
View 4 Replieshere's what I have:
My asp.net 3.5 app uses Forms Authentication.
I create an authentication cookie (ticket) with an expiration date of one day.The cookie'sIsPersistent is set to true.
I do not use any session variables.
Session timeout is the default 20 minutes.
Here's the problem:
When the session times out in 20 minutes, the user is redirected to the logon page even though the authentication cookie has not expired.
Why does this happen? I thought the cookie and the session worked independently. Shouldn't the user remain logged in as long as the cookie hasn't expired?
i have a secure ASP.net application ,login page and all these stuffs, i want to create a windows desktop application for some resones but i want to use the same security of the asp.net , is there anyway to get the login information of the asp.net to login to my windows desktop application?
View 1 RepliesLet's say I'm currently authenticated in an application (namely: applicationA) and I click a link that will take me to another application (namely: applicationB). Is it correct that in order to bypass authentication of applicationB, I'll just create a ticket for that application telling the web server that I'm already authenticated?
View 5 Repliesi have a custom class has extra information about my users , i want to create an object of this class and attach it to current Authentication ticket , what is the best way to do that , i have read there is a userdata thing in the authentication ticket but it's type is String
View 5 RepliesI'm having a problem trying to delete the form authentication ticket (.ASPXAUTH) from the server side. It would be the same to delete or invalidate the ticket so the client could not reuse it.
So far, the only solution I've found is to delete the ticket from the client side (through a "Set-Cookie: .ASPXAUTH=;") but nothing seems to be implemented and/or working for doing so in the server side. The final idea is that if someone steels that ticket
In particular, I'm working in C# but as it's rellated to the Dotnet Framework any implementation of the solution would be OK; I tried all the possible things and nothing worked out, even invalidating the session but nothing.
I don't know if the following is possible or not but in brief, here is what I'm trying to achieve:
1. When a user requests to view a document, they click on a link (could be other) which contains an encrypted query string containing data required to retrieve the relevant document. i.e.[URL]
2. I want to ensure that if after x minutes the user goes back to their history and select the link again or re-type the same url as above that it will not request the document and redirect them to a page letting them know that the requested document "link" is no longer valid.
I don't want to rely on cookies or sessions, so thought that maybe there would be a way to add a datetime token at the end of the existing url but this needs to be done at run-time as the url is already predefined when the link is created, so I'm not sure how can I do this?
ideally, I'd like something like this [URL] where the token would contain the date & time when the link was clicked.
Once re-requested, I would decrypt the token and validate it again the server time and if it was over the x minutes defined, it would redirect me to the "link is no longer valid" page.
Using C# and sqlmembershipprovider forms authentication, is there a way to force user password to expire and need to be reset after x number of days?
So if a user launches the website login.aspx page, when they type their userid, it will check if the password is expired and direct them to a Resetpassword.aspx page?
I am developing a new website that is membership based with yearly subscriptions. Using VS2010/asp.net4/c#. I have my site up to the point where all my content is ready to go and i can add members to the database to access all the premium content.
However, I have no idea how to impliment a start date and expiration date for that membership. I have been following along with Wrox Beginning asp.net 4.0 from beginning to end and this isn't covered at all. I also have Apress Pro asp.net 4 as well and I cant find anything dealing with that in there either.
What I would love to be able to find is some book or tutorial that i can follow along with and learn from so that this doesn't happen again to me.
In short what I need to do is this.
1. Add new user to defined membership role
2. Apply start/end date to that user
3. When the end date has passed I need to reasign them to a new role and then redirect them to another page with a notification
4. I guess lastly some way to add/manage members as an admin on my deployed site. Durring development i was using the built in Web Site Admin Tool but I just found out that only works on my local machine.
I have a feeling this this will be a very simiple fix but because of my total lack of experience it has been driving me crazy for three days tyring to hunt down info.
we recently upgrated our project from 1.1 to 2.0. since then we are seeing "Forms authentication failed for the request. Reason: The ticket supplied has expired" in Event Viewer. this keeps coming 1-2 times for every minute. this is the full message. this also made the response time increased it seems.
Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Event time: 1/25/2010 5:00:30 PM
Event time (UTC): 1/25/2010 10:00:30 PM
Event ID:
Event sequence: 20601
Event occurrence: 2692
Event detail code: 50202.....
For some reason my users are logged out of the system every 10-15 minutes or so...regardless of the configuration below....am I missing something?
[code]....
How i redirect the page to Login page automatically if session Expires .
View 7 Repliescan u tell me how to automatically sign out a user if he/she closes the browser window without signing out. I'm using Forms Authentication.
View 1 RepliesIf I have following code in my web.config file
<authentication mode="Forms">
<forms name="appNameAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30">
</forms>
do I still have to create "Ticket" manually in code behind to actually create a login ticket as:
[code]....
Since we updated our website to .NET 4.0, users using a proxy-server can't login in our webapplication anymore.In the event-viewer on the server this error is thrown:Forms authentication failed for the request. Reason: The ticket supplied was invalid.This problem only exists for users with a proxy, all other users can login normally.We are not using a web garden or multiserver (load balance) environment, just a webserver and a databaseserver.
View 4 RepliesI have a requirment , my site is using Formauthentication cookie to validate the users , so once the same user is logged in to another browser again ( same Machine or different) then I need to log off the first site and need to allow the second one active.I am thinking to implement this by storing a uniqueID in the DataBase user table .Once the user Logs in then I will store this ID in to the database and for each request I will check whether the ID is same or not, once the user logs again in to another browser then the Unique ID will get generated again and store (update the previous one) to the user table so that the request from the fisrt instance browser will fail to validate and kick out to login Page.this procedure will reduce the performance since all the time it need to intract with DB, so is there any other possible way to Implement this scenario with out using BD - but using formauthentication cookie.
View 1 RepliesI simply want to know how to manually check if the value a user has provided for the answer to their security question matches their current answer on record. I want to use the build in support of the membership and membershipuser objects.
I see that via the passwordrecovery control that the actual answer can be returned. However I am currently not using this control and it would take a good bit to integrate it as it does not meet our user's requirements.
In a worst case scenario, getting the actual answer (like the passwordrecovery control does) and manually checking it in our application would be acceptable.
A best case scenario is some sort of API where I can pass in the user name and the answer to their security question that was provided and simply get an indication of whether answer was correct or not.
I have created a customer RSA key container (for encrypting connection string in web.config) using the following command:
aspnet_regiis -pc "TestKeys" -size 2048 -exp
I then exported the key to an xml file and used it to initialise an instance of RSACryptoServiceProvider so that I could check the key size was definitely 2048. However, using the code below, the key size is displayed as 1024.
[Code]....
It seems that aspnet_regiis is ignoring the -size argument. Am I missing something? Also, is there a recommended key size for encrypting .Net config sections using RSA?
I want to create a small helpdesk ticket control system at work, that would allow users to enter a help request ticket; these tickets would then be assigned to a technician to work on, and the technician would mark it as "FINISHED" after the job is done. The requesting user would then be able to confirm and "CLOSE" the ticket, so that a Help Desk supervisor can keep track of response times and other stats based on the ticket details. Nothing too complicated, using .NET and SQL Server.
I am not sure if I should develop this as a Web application or a Windows application. This application would be used in the plant floor, so it would have to be easily available in the LAN. But we currently host a list of Windows applications via Citrix, so deployment would not really be an issue here. I don't really have experience creating winapps from scratch (though I've modified quite a few), but it feels like a web application would not look as "solid". What advice can readers provide that could guide me into deciding the better architecture for this purpose?
I want to create a page for the student to download the hall ticket by putting their rool no and date of birth in the textbox and authenticating it.... I am planning to use xml file for student data, how can i do this, how cant retriew the data and generate a pdf file and allow it to download...
View 1 RepliesI am new to this so forgive my lack of techical jargon/understanding.
We have and active directory setup in our dmz for 'external' user authentication to our web sites. This works fine...
We also have 'internal' users who have been authenticated to our 'internal' active directory. That works fine.
The problem is that we would like the internal users to be able to access the web sites on the web server in the dmz without getting prompted for authentication a second time...the user has already logged into the AD internally. Is there a way for this to happen? Currently they are being prompted for their credentials any time they go to login to a web site that is located in the dmz.