Re: HttpWebRequest and Forms Authentication

From: Jorge Matos (JorgeMatos_at_discussions.microsoft.com)
Date: 10/22/04 

Date: Thu, 21 Oct 2004 15:55:08 -0700

I didn't know about Fiddler - gotta look into that. I disagree about the
separate request though, if the user is already authenticated then you can
programmatically access the Forms Auth Cookie that is already present as a
header in the current request context, and since Matthew is hitting a web
page that is already in the site this should work. I agree with you only if
you are hitting an external web site that is using Forms Auth.

"Joe Kaplan (MVP - ADSI)" wrote:

> Before that, you will probably need to make a separate request to the
> authentication page and post some credentials so that you can get the cookie
> value to begin with. It may be possible to hardcode a cookie value that
> will work, but generally these things expire, so you'd probably need to get
> one dynamically. Use an HTTP debugger like Fiddler to see the exact format
> of the post so that you can replicate it in code.
>
> In general, forms auth is not well suited for screen scraping or web
> services-type of authentication. However, you can do it if you really want
> to.
>
> Joe K.
>
> "Jorge Matos" <JorgeMatos@discussions.microsoft.com> wrote in message
> news:5E2C9A0A-0A1F-43B2-A78C-B012657A9744@microsoft.com...
> > You probably need to add the Forms Authentication cookie as a http header
> > in
> > your request to the other web page. The WebRequest type has a "headers"
> > property that you can use to add the Forms Authentication cookie to - then
> > when you make the request with the WebRequest object, your forms auth
> > cookie
> > will go along for the ride.
> >
> > hth
> > Jorge
> >
> > "Matthew Judd" wrote:
> >
> >> I am using Forms Authentication on my site, this process mostly works
> >> fine.
> >> The problem I am having is that I have a page that uses an HttpWebRequest
> >> object to get the html generated from one of the aspx pages within my
> >> site,
> >> which it then emails to somebody. The problem I have with this is that
> >> the
> >> email gets the login page instead of the page I requested, because when I
> >> do
> >> the WebRequest it gets sent to the forms authentication login page that I
> >> have specified. I need to be able to get my WebRequest to bypass the
> >> forms
> >> authentication for this request, but I do not know how. Any suggestions
> >> would
> >> be appreciated.
> >>
> >> Matthew Judd
>
>
>

Relevant Pages

  • Re: Problem with Forms Authentication cookies
    ... > only 2, the ASP.NET_SessionID cookie and the Forms Authentication cookie, ... > The next request coming is is a GET request for the Forms Authentication ... > In looking at the logs for NORMAL expired authentication redirects these ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Forms Authentication problem with WebRequest
    ... The normal request will go like this: ... handles login, redirects to page.aspx, passes a cookie or url variable ... reqests page.aspx and sends cookie back to server ... - authenticating has nothing to do with this scenario, but with server authentication. ...
    (microsoft.public.dotnet.framework)
  • Problem with Forms Authentication cookies
    ... We're having an issue with Forms Authentication cookies being treated as ... Session timeout is set to 45 minutes in web.config ... The log shows the cookies sent in with the request - ... only 2, the ASP.NET_SessionID cookie and the Forms Authentication cookie, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: HttpWebRequest and Forms Authentication
    ... you will probably need to make a separate request to the ... authentication page and post some credentials so that you can get the cookie ... >> the WebRequest it gets sent to the forms authentication login page that I ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Forms Authentication to protect a cgi application
    ... problems getting hold of cookie information from within the ISAPI. ... authentication redirect and processed by the ISAPI and if not verified ... > app domain from the ISAPI in order to use forms auth? ...
    (microsoft.public.dotnet.framework.aspnet.security)