Forms Auth not recognizing cookie on return to site (1.1)

From: Cy Huckaba (cyh_at_delete.t-3.com)
Date: 04/29/03 

Date: Tue, 29 Apr 2003 12:05:09 -0500

I recently upgraded to .Net 1.1 and ran into this problem. I had no problems
with my forms auth code with 1.0.

A user can come in a login against a DB and set a cookie (persists it as
well) and be fine for the rest of the session. When the user comes back they
don't get logged in and they don't even get redirected to the correct login
page.

They app is setup as a virtual web under the root website. My site consists
of one root and a virtual web for each client.

The root website is configured for None as the authentication type with
allow users="*". No real security here. Each site has it's own web.config
file pointing to a login page inside the vir web.

<forms path="/acme" loginUrl="/acme/login.aspx" timeout="30"></forms>

The login page handles the login for the virtual web and sets the cookie if
the user chooses.

Everything works fine everytime I come back if I don't choose to persist the
cookie. When I test the login after choosing to persist the cookie I get
redirected to a login page off of the root website ... /login.aspx. This
doesn't exist, so it's basically a asp.net 404 error description stating
server error in "/" app...not even the right subweb.

I tried to remove the IsolateApps attribute in the machine.config keys that
I saw in previous postings, but that didn't seem to make a difference.

Any Ideas?

Cy Huckaba
Austin, TX

Relevant Pages

  • Re: Forms Auth not recognizing cookie on return to site (1.1)
    ... 1.0, stopped working in 1.1. ... > A user can come in a login against a DB and set a cookie (persists it as ... > They app is setup as a virtual web under the root website. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Cookies Expiring due to different time zones.
    ... post to your aspx login, sending the cookie's date in a hidden field ... set the aspx login cookie using the date/time in the hidden field ... This is the code I am using to create the ticket, ... Your problem is that you're using an extremely short time for the cookie expiration. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Accessing and displaying SSL web pages and cookies from a windows form
    ... or LoadXML calls to urls on the website in order to get data or post data to ... first redirected to a SSL login page, if a particular cookie is not present, ... cookie is not present instead of getting the data. ... >> the data in the cookie and also not redirect to the login page. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: [PHP] Need secure login
    ... Thanks Justin, actually I was also thinking of the same, but just wanted to ... > c) the user not deleting the cookie ... > Likewise, you can't tie a member to a mac address, or to an IP address. ... Make sure that a user can't login from two different places at ...
    (php.general)
  • Referencing variable in calling class?
    ... I assume because the cookie destruction is being sent down in that page ... when that page renders it still appears as if the user is logged ... So, I thought perhaps as part of my logout routine, I could set a variable ... whether or not it displays the 'login' url or the 'logout' url. ...
    (php.general)