Problems with Forms Auth and Session State.

DanR_at_REMOVETHISTOGETTOME-warshawgroup.com
Date: 07/02/03

  • Next message: Naveen K Kohli: "Re: Server 2003 problem with asp.net." 
    Date: Tue, 1 Jul 2003 18:17:59 -0400

    Clearly Forms Authentication manages it's Authorization state using a
    different cookie than the Session cookie. I am running into the problem
    (particularly while developing) that my Auth cookie is still valid while my
    session data is gone/has been deleted. Anyone else running into this?

    The whole idea is to have the ASP.NET framework manage an 'isLoggedIn' sort
    of framwork, so that I don't have to build my own. What I am doing, then, is
    using Forms auth to auth the user and set the Auth cookie. Then I stick
    stuff in session.

    I often find myself in a state where the Session is void, but the Auth
    framework is still allowing me to get to pages as though I am a logged in
    user.

    Does that make sense? I can post code, but you folks should know what I
    mean. Anybody else seeing this? What do you do for session management?

    -DanR

  • Next message: Naveen K Kohli: "Re: Server 2003 problem with asp.net."

    Relevant Pages

    • Re: php vs. apache login verification security?
      ... This would make it easier to maintain the auth and other global routines ... > into the cookie to allow for session identification. ... The hashing of username and password is -only- to prevent ...
      (alt.php)
    • Re: Questions About Session Timeout
      ... The IIS config will handle the session state, and the forms auth will handle the authentication cookie. ... This is what the auth cookie lifetime is for, which you set in the forms auth section of the web.config. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Problems with Forms Auth and Session State.
      ... At the point my user authenticates, I set up their session variables. ... >> different cookie than the Session cookie. ... >> using Forms auth to auth the user and set the Auth cookie. ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Sessions vs Cookies
      ... There is a session cookie which simply allows the server to identify the client and retrieve relevant session data for it. ... If cookies can be read or forged, it makes little odds whether you have the master key or all the little keys,. ... Suppose you only send the PHPSESSID: Now you cannot change a thing on the server, even if you have the 'master key'. ...
      (comp.lang.php)
    • Re: session wont timeout
      ... Maybe this is a session cookie issue? ... client browser there is this one: WSS_KeepSessionAuthenticated Expires: At ... If I kill the session cookie using IE Developer Toolbar, ... possible and IIS would throw another challenge. ...
      (microsoft.public.sharepoint.windowsservices)