i have a custom class has extra information about my users , i want to create an object of this class and attach it to current Authentication ticket , what is the best way to do that , i have read there is a userdata thing in the authentication ticket but it's type is String
View 5 Replieshere's what I have:
My asp.net 3.5 app uses Forms Authentication.
I create an authentication cookie (ticket) with an expiration date of one day.The cookie'sIsPersistent is set to true.
I do not use any session variables.
Session timeout is the default 20 minutes.
Here's the problem:
When the session times out in 20 minutes, the user is redirected to the logon page even though the authentication cookie has not expired.
Why does this happen? I thought the cookie and the session worked independently. Shouldn't the user remain logged in as long as the cookie hasn't expired?
I'm having a problem trying to delete the form authentication ticket (.ASPXAUTH) from the server side. It would be the same to delete or invalidate the ticket so the client could not reuse it.
So far, the only solution I've found is to delete the ticket from the client side (through a "Set-Cookie: .ASPXAUTH=;") but nothing seems to be implemented and/or working for doing so in the server side. The final idea is that if someone steels that ticket
In particular, I'm working in C# but as it's rellated to the Dotnet Framework any implementation of the solution would be OK; I tried all the possible things and nothing worked out, even invalidating the session but nothing.
we recently upgrated our project from 1.1 to 2.0. since then we are seeing "Forms authentication failed for the request. Reason: The ticket supplied has expired" in Event Viewer. this keeps coming 1-2 times for every minute. this is the full message. this also made the response time increased it seems.
Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Event time: 1/25/2010 5:00:30 PM
Event time (UTC): 1/25/2010 10:00:30 PM
Event ID:
Event sequence: 20601
Event occurrence: 2692
Event detail code: 50202.....
Since we updated our website to .NET 4.0, users using a proxy-server can't login in our webapplication anymore.In the event-viewer on the server this error is thrown:Forms authentication failed for the request. Reason: The ticket supplied was invalid.This problem only exists for users with a proxy, all other users can login normally.We are not using a web garden or multiserver (load balance) environment, just a webserver and a databaseserver.
View 4 RepliesI am using the ASP.NET login control. I want to be able to set the timeout for Forms Authentication individually for each user (instead of globally in the web.config). From what I understand the only way to do this is to set the timeout on the AuthenticationTicket manually. Is there a way to do this when using the Login Control? It seems to me that the Login Control abstracts away all of this. I am hoping that there is some way to continue using the Login Control, but also have the ability to set the FormsAuthentication timeout individually for each user.
View 2 RepliesDoes anyone know how to add a generic principal to the HTTPContext from the Forms Authentication Ticket?
View 1 RepliesI have an ASP.NET website that uses Forms authentication
<authentication mode="Forms">
<forms name="NewsCoreAuthentication" loginUrl="~/Default.aspx" defaultUrl="~/Default.aspx" protection="Validation" timeout="300" domain="someRootDomain.com" />
</authentication>
I need to identify if user is authenticated on web page after it was rendered to client. To accomplish this I thought that I can read document.cookie and check if ".ASPXAUTH" is there. But the problem is that even if I am signed in this value is empty.
How can I check that user is authenticated? Why document.cookie is empty?
I have used the Forms Authentication for logging in and in that i have created the Forms Authentication Ticket and in that ticket i have passing the data with comma seperated values.how can i get the data which is in the ticket to access in the Authenticated user pages
View 1 RepliesWay to get FormsAuthenticationTicket after user logged in?
View 4 RepliesThe constructors for manually creating FormsAuthenticationTicket objects force us to set an "expiration" value, and this value overrides the "timeout" setting in web.config in my tags, which is not what I want, because now the user doesn't timeout. The "session" just expires at the given time.I need to manually create my ticket for UserData reasons, and it is just the way I decided to build my app. I guess I could spend a whole lot of time and redo the way my app. authorizes, and store the "userdata" elsewhere... but this seems extremely tedious for something so small..Is there anyway to manually create an Auth Ticket and still maintain timeout settings?! And by timeout, I mean resetting the timer on user activity. Not a fixed timeout!
View 1 RepliesI am getting this error many times in the event log , and users are logged out .
Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Event time: 3/10/2011 3:35:22 PM
Event time (UTC): 3/10/2011 8:35:22 PM [code]...
I am not using web farms. I do not think the app pool is recycling , i compared the Process ID in several events and it is equal . My machine key is not AutoGenerate .
My event log is flooded with this message: Forms authentication failed for the request. Reason: The ticket supplied has expired.I think this happens when people timeout instead of logout.First of all , this is not an error, it's Type: InformationI don't want this information, how do I stop ASP.NET from logging it?My application is not web-farmed, and uses a static machine key.
View 1 RepliesI am developing a asp.net application using SQLServer 2008 and I have a page "Default.aspx" in which i have userID and Password textboxes and a SUBMIT button. Here is the script I am using to authenticate.
[Code]....
Well now i want to know that by using FormAuthenticationTicket how can I check on other pages if user is authenticated user cause in the URL if i just change the page like "Main.aspx" and hit it takes me there which should not happen and redirected to Login page.
How should i check on every page on page load event if user is authenticated or not and if not then redirected to Login.aspx.
I have a asp.net application where i am using FormAuthentication Ticket when user Sign in....on each page I want to check if FormAuthentication Ticket has expired ...how to do this ?..
View 6 RepliesI have a web app that uses window.openModalDialog to display a page. This page has a hyperlink that connects to an HttpHandler to retrieve a file. The link has a target property of "_blank". We've recently implemented Forms Authentication on this site in place of a flaky proprietary solution and we are noticing that now whenever we click on that link we get a pop-up window and the login screen appears.In the authorization section of the web.config we're saying that we don't want to allow anonymous. However, if I add a location element with the URL the handler is associated with, I can hit the breakpoint in the ProcessRequest method because it doesn't care if I'm not logged in. What's odd is that I should be logged in so it seems that the authentication ticket (which isn't expired yet) isn't being accepted in the popup window. If I allow anonymous I can bypass this problem, however the code that retieves the file relies on Session data and it's null. Therefore, either way I can't get this to work.It has been suggested that instead of a modal dialog just use window.open, however I'm reluctant to do that because when this window is open I don't want users accessing the parent window due to several reasons. Is there any way to get around this problem? I don't want to ditch forms auth for the old way because it wasn't secure.
View 1 Repliesi have a secure ASP.net application ,login page and all these stuffs, i want to create a windows desktop application for some resones but i want to use the same security of the asp.net , is there anyway to get the login information of the asp.net to login to my windows desktop application?
View 1 RepliesLet's say I'm currently authenticated in an application (namely: applicationA) and I click a link that will take me to another application (namely: applicationB). Is it correct that in order to bypass authentication of applicationB, I'll just create a ticket for that application telling the web server that I'm already authenticated?
View 5 RepliesIm passing sensitive details from my asp.net web app to a database on a different server. I've set up encryption on my database. Should I encrypt the data in the code behind file of the web app and then pass it to my database stored procedure or pass it to the stored procedure as it is and encrypt it there?
View 4 RepliesI have an asp.net site. Its a mixture of web forms and MVC2.
I have this on 2 different servers which I get to via different urls.
On one server authentication works fine via all browsers (IE 8, FF 3.6, Chrome)
On the other IE 8 fails, it doesn't send back the cookie on the request to the page after authenticating.
Using Fiddler I have seen that both sites attempt to set the cookie, in the response from the login page.
Response Header I see from both servers
Set-Cookie: DemandLaunch=CCA4...E79C2D1; path=/; HttpOnly
Both sites are in the internet zone of IE.
I'm at a loose for what to check now.
I also have a page that sets a cookie via c# code and that cookie fails in IE as well.
The IE issue is not on a single computer either. I see this failure on 4 different computers Internet Explorer.
My urls which I should have included were:
beta.[site].com - works
beta_[company].[site].com - fails
I want to create a site where users can create a very basic profile, with fields like full name, City, Age and Gender, and I want the data for every new member that signs up to go into a simple Table in my sql data base. reason being I want members to be able to view other members info in a table. I am familiar with the "CreateUserWizard", but that only allows me to work with certain predefined info (email, user id, etc). If I just anually add new columns to the table in which user ID and such is saved to, and customize the CreateUserWizard controller to have text boxes for the additional data that I want (i.e. city), will the CreateUserWizard know to save that additional data in the table?
Also, I know I can add fields to the <profile> tag in the web.config files, but I dont know where that gets stored. I want all the info for the user to be stored in one table in a sql data base so that I can easily access it with a quary. I dont see where the profile properties get stored, and how it can be linked to a User ID. by the way I noticed in other posts, there was a mention of a membership provider. I noticed that although I've added some "Login" controlls (i.e. login and CreateUserWizard), no membership provider has been added to my web.config file. Do I need to do this manually? or is there a menu item that adds it for me?
If I have following code in my web.config file
<authentication mode="Forms">
<forms name="appNameAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30">
</forms>
do I still have to create "Ticket" manually in code behind to actually create a login ticket as:
[code]....
This could be very straight forward for some of you, but I got caught up. I am doing very simple test - browsing from IIS Manager to see the default page or "under Construction", however I am being challenged to provide my login credential . When I provide my login credential, I am able to see the default page. I wanted to see the default page without providing my credential since Enable anoymous access + basic authentication I am simply wanted to see the default page asit is working on other servers except this one. I have included screen print to make sure may question is clear.
View 3 RepliesWhat's the difference between Basic Authentication and Integrated Windows Authentication in IIS?
View 3 RepliesI set authentication mode to Windows in the web.config and I enable Windows Authentication and disable the Anonymous Authentication in IIS 7 on win 7, but HttpContext.Current.User is always null.It works fine when I host the web app in IIS 6.0.
View 1 Replies