Forms Authentication with Session State

From: Max Q (mquagliotto_at_surgesoft.com)
Date: 07/24/03 

Date: Thu, 24 Jul 2003 11:41:12 -0700

Hey All.

Currently, I have a login page that creates an encrypted
Authentication Cookie (using FormsAuthenticationTicket).

This happens after the user has been successfully
authenticated by matching credentials in SQL Server
tables (not using Windows Authentication... just matching
login name and password to their user record within a
table in SQL Server).

I set the authticket to expire 20 minutes after it's been
created, and it uses the
FormsAuthentication.FormsCookieName to grab the cookie
name from web.config.

Now, I also have my session state (mode="InProc") timeout
set to 20 minutes in the web.config file...

This USED to work before for me, but now when the user
times out, it will NOT redirect to the login URL
specified in the web.config file (under the
authentication element)

here's a snapshot of my web.config file:

  <authentication mode="Forms">
    <forms
loginUrl="Insecure/Session_Expired_Redirect.aspx"
name="sqlAuthCookie" timeout="20" path="/"></forms>
  </authentication>

Even if I set my session timeout to something earlier
(like 10 minutes), and put code in Session_End in the
Global.asax file to force a FormsAuthentication.SignOut
(), it STILL won't redirect to the loginURL specified in
the web.config.

Does anyone have any suggestions how I can
properly 'synchronize' Forms Auth and Session State in
this web app? (If you need more info let me know)

Relevant Pages

  • [Full-Disclosure] Advisory: Dark Age of Camelot - Weak encryption of network traffic exposed persona
    ... Weak encryption in game client exposed customer billing and authentication ... encryption for billing information. ... The login binary has undergone several updates since then. ...
    (Full-Disclosure)
  • Re: [PHP] Is this the best way?
    ... Why is Jason schreefing again? ... maybe I should edit my authentication function... ... attempting to login. ... really be either attempting an authentication *or* outputting some ...
    (php.general)
  • Authentication Sharing Across Apps
    ... For my part "B" question that I had (Login App was not returning ... authentication to calling app), I found the solution. ... Basically, in both the Login App and Calling App Web.Config, I did ... authenticated connection with SQL server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: [PHP] Is this the best way?
    ... Jason Pruim schreef: ... I am attempting to add a little error checking for a very simple login system. ... So maybe I should edit my authentication function... ... really be either attempting an authentication *or* outputting some message ...
    (php.general)
  • Unable to get IP Address from DHCP server - 802.1x authentication
    ... user based VLAN authentication with Windows client as ... Authentication method: MD5-Challenge ... Login locally with the cached profile of user1 ... After entering the Radius server username & password the ...
    (microsoft.public.win2000.security)