Security :: .net Session And Remember Authentication Method?
Dec 18, 2010
I'm currently developing a website using .net MVC 3 and I'm on the authentication layer...Here is the scenario: user is logged with the "remember me" option checked : a user Session is created on the server as well as the authentication cookie on the client side.The Session timeout is set to 20 minutes.After 25 minutes of inactivity the user goes back onto the website and Session, now expired, does not exist anymore but the authentication cookie still exists
This could be very straight forward for some of you, but I got caught up. I am doing very simple test - browsing from IIS Manager to see the default page or "under Construction", however I am being challenged to provide my login credential . When I provide my login credential, I am able to see the default page. I wanted to see the default page without providing my credential since Enable anoymous access + basic authentication I am simply wanted to see the default page asit is working on other servers except this one. I have included screen print to make sure may question is clear.
In login control of asp.net there is a remember me checkbox. What is the functionality of this checkbox? What it does basically? Is there any way to put space between checkbox and its associated label?
I saw Windows Live login control has an extra checkbox Remember my password? How can we achieve this feature in our custom login control? I have read many tutorials but I can not able to solve my queries.
i have a login, and wanted to know how i could use the remember me function, (so each time the user visits the site, even though they are not logged in, it would auto log them in) but without using the actual remember me checkbox. Is there any extra code i need to write, and if so, what?
Is there any way that I can create a session variable AFTER authentication? It needs to be populated from the users record in a sql database. Basically I tried using Application_AuthenticateRequest in global.asax with an application variable but this made it available to all users. Using session_start is not working as when this runs my user is not currently logged in, so the variable is always empty when I try and grab it's value.
It pulls through the Username correctly from the cookie, however the CheckBox for Remember Me does not become checked when I view the page, even though the code for setting it on the Page_Load is being executed.
LoggedIn event for setting the cookies protected void lLogin_LoggedIn(object sender, EventArgs e) { // If Remember me then set an appropriate cookie if (lLogin.RememberMeSet) [code]...
im having a login control in my website with a remember me option. i check the remember me but it does not remember me. here is a part of my web.config. i browsed over the other answers on this forum but nothing :( I also have the cookies allowed
I have 3 seperate applications (under the same domain) for which I use Forms authentication with single sign-on.
The 3 applications have different session timeout periods. I was on various articles that when we use forms authentication and specify the loginurl in the <Forms> tag in the web.config, it should automatically get redirected to the login page, when the session timesout. But in my case, it doesn't happen, I think because of different timeout values.
I create an authentication cookie (ticket) with an expiration date of one day.The cookie'sIsPersistent is set to true.
I do not use any session variables.
Session timeout is the default 20 minutes.
Here's the problem:
When the session times out in 20 minutes, the user is redirected to the logon page even though the authentication cookie has not expired.
Why does this happen? I thought the cookie and the session worked independently. Shouldn't the user remain logged in as long as the cookie hasn't expired?
I am using form based authentication in one of my website. I issue AuthenticationTicket on successful login and use this ticket to validate request. but now I need to store other variables immidiately after authenticating request (just like adding session for username, email etc. variable after successful login).
My question is if I make use of session to store variables, do I need to concern about it as form based authemtication is cookie based and it is not related with session timeout.
Using VS 2010 RC, VB, and Forms authentication to allow access to the site, depending on the login rights of a user, I want to turn on and off access to certain pages. I can turn on and off buttons to access the pages, but a user can type the page into the url, and it will still go to them.
I am new to C# , i've build a simple web form which shows a result based on 4 pulldown menus. I wish to save this result during the session the user spends on the website, untill the user resubmits the form. So when coming back to the result page, the search results are still shown.http://www.estatewise.nl to see the form in action.
I am trying to force to show to the Logon popup when the session is timeout in Integrated Windows Authentication Enabled website. The session_timeout is firing during the session timeout, but the User.Identity.IsAuthenticated is true. How force to use the Windows Logon Screen when the session is timeout.
I am new to c# and i have problem in using login control. I made a simple login page and it works fine but i dont know how to use the remember me next time option.
We have a page where we ask users to enter only password in "enter password page" (the user name is taken in previous page).
The Issue is that when the page that asks user to enter password is opened in browser and when user enters password and clicks submit button, the browser does not ask the user to remember/save password,
Due to this when user opens that page next time, user have to retype the password.
You might have seen that in almost all sites whenever we open a login page, the browser asks weather we want to remember the password for next visit.
From the research done so far, we have found that browser remembers password only when the username and password textboxs are on the same page. But in our case we split down the username textbox and password textbox in two different pages.
Is there any way to let browser ask to user weather to remember/save password in "enter password page"?
I would like to set the Login which will log auto when he return to site, if the user hasent logged off the site.and if he enter the site again he'll be logged in already.
This code worked until I published a recent set of changes to the web site. It's very strange behavior that I am having trouble debugging. Basically, I implemented some custom code to allow custom configuration of login timeouts from an app settings variable.
When debugging the application, if I click remember me or not, Login works perfectly. Once I post the updated code to the live server, login only works if I have the Remember Me option unchecked. If I check remember me, it does not log in, and it cycles the user back to the default web page. If I access the site from IE on the live server, remember me works correctly.
I set authentication mode to Windows in the web.config and I enable Windows Authentication and disable the Anonymous Authentication in IIS 7 on win 7, but HttpContext.Current.User is always null.It works fine when I host the web app in IIS 6.0.
