Restricting cookie transmission with Forms Authentication to particular pages

From: Todd Meynink (todd@ntf.com.au)
Date: 11/27/02 

From: todd@ntf.com.au (Todd Meynink)
Date: 26 Nov 2002 15:30:39 -0800

Hi,

I'm reading Jeff Prosise's "Programming Microsoft.NET". I've
implemented his Forms Authentication example as per the ASP.NET
security chapter - this chapter is identical to the article posted on
MSDN:

http://msdn.microsoft.com/msdnmag/issues/02/05/ASPSec2/default.aspx

I've setup SSL on the web server and have required SSL for pages in a
"Secret" subdirectory of the virtual root.

Once a user is authenticated, I only want the cookie transmitted when
the user is viewing pages in the "Secret" directory. The default
behaviour is to transmit the cookie with all requests once a user is
authenticated. Jeff suggests that adding

<forms ... path="/Secret" />

to web.config is the solution. However, once I do that, if I log in
correctly, rather than be redirected to my original request for
ProtectedPage.aspx, I am sent to the log-in page again. Removing the
above line causes things to work again, but I'm back to transmitting
the cookie all the time, including over unsecured channels.

Any ideas?

Cheers,
Todd.

Relevant Pages

  • RE: Forms authentication cookie handling question (C#)
    ... I also replaced all of my ticket authentication code with the ... // Username and or password not found in our database... ... LoginControl's default code logic to generate authentication cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Forms Authentication
    ... The DNS entry for my domain was not set corrretly, ... This should have overcome the cookie ... authentication ticketis not correctly set to the domain your ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Forms authentication cookie handling question (C#)
    ... programmatically generate forms authentication ticket and set it in ASP.NET ... You use the Login control's "Authentication" event to do the user ... LoginControl's default code logic to generate authentication cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: authentication cookie vs session cookie
    ... level of using authentication cookies on the client machines. ... authentication cookie on a manager's machine is stolen and used on a client ... > session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: forms authentication cookie problem
    ... authentication cookie. ... what's going on on the server. ... >324488 Forms Authentication and View State Fail ... >characters, the browser will still request the page, but ...
    (microsoft.public.dotnet.framework.aspnet.security)