Cookies question

From: Joe Fallon (jfallon1_at_nospamtwcny.rr.com)
Date: 03/23/05

  • Next message: brian f via DotNetMonster.com: "password help" 
    Date: Tue, 22 Mar 2005 18:21:33 -0500

    I use forms authentication for my app.
    After I log in successfully each request by the browser contains 2 cookies.
    One for the SessionID and one for forms authentication which contains my
    ticket.

    Can someone please explain where these cookies are stored? I think it is in
    memory in the browser but am not sure.

    Also, some users have stated that they can do the following:
    1. Start a browser, hit the site and log in.
    2. Start a 2nd browser.
    3. Hit the site.
    4. BYPASS the log in page and go directly to the Home page.

    They claim they can also close all browser sessions, start a new one and
    still Bypass the log in page.

    How is this possible?
    Why would the 2nd browser session have the cookies noted above?

    I assume once the authenctication ticket expires in 30 minutes of inactivity
    that neither scenario would be possible. They would have to re-log in first.

    Thanks for any info on this. 

    -- 
Joe Fallon
  • Next message: brian f via DotNetMonster.com: "password help"

    Relevant Pages

    • Re: Forms Based Authentication and the OpenWave Browsers
      ... Try taking this redirect out of the try...catch; ... > Authentication in cookie enabled WAP browsers. ... > Samsung Browser, Forms Authentication and RedirectFromLoginPage - This is ... > Open Wave Browser and Cookies - While regression testing my new change, ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: hiding session ID in browser
      ... Store your data somehow indexed by this ID, ... properly with cookies enabled. ... > Problem why I don't want SessionID in browser is because when you add ... > web-site to favorites it stores SessionID too. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: SessionID Changes in production machine....help
      ... Check your browser settings again. ... > My browser is configured to accept cookies, so really I shouldn't have to ... is there some thing else that could cause the sessionid ... >>> I posted another thread here asking help because I was losing my session ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: SessionID Changes in production machine....help
      ... My browser is configured to accept cookies, so really I shouldn't have to ... is there some thing else that could cause the sessionid ... >> I posted another thread here asking help because I was losing my session ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Querystring - cookieless = true
      ... ich habe leider bemerkt, dass einige User Ihre Sicherheitseinstellungen so hoch haben, dass keine Cookies erlaubt sind. ... Der Hinweis unten im Browser wird häufig übersehen. ... SessionID als QuerystringParamneter ...
      (microsoft.public.de.german.entwickler.dotnet.asp)