Re: forms authentication cookie changes

From: Dominick Baier [DevelopMentor] (dbaier_at_pleasepleasenospamdevelop.com)
Date: 07/21/05 

Date: Thu, 21 Jul 2005 10:07:16 -0700

Hello Andy,

FormsAuth issues a new cookie after timeout/2. That's the behaviour when
you have sliding expiration enabled.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> Hi all,
>
> For reasons I would rather not go into, I sometimes need to get the
> value of the forms authentication cookie and use it later when
> submitting another request to the server.
>
> mostly this works fine but sometimes it seems that the server decides
> to change the forms authentication cookie (in contrast to the session
> cookie which stays the same the whole time the session is in
> existence).
>
> note that this is not happening because the authentication timeout has
> expired. I am still logged on as the same user and have the same
> session; it's just that the cookie value has changed.
>
> Can anyone explain why and how this happens, and if there is any way I
> can control (or disable) this behaviour?
>
> TIA
>
> Andy
>

Relevant Pages

  • Re: proper way to logout and end a session
    ... also the authentication cookie is separate from the session cookie. ... as the second site is opened from the first, its cookies are not deleted by the browser when the window is closed, so when the site is reopened, the authentication cookie is still active. ... And when people click the logout link inside the application, the application will close this second browser window. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Problem with Forms Authentication
    ... not persist the authentication cookie beyond the session ... so each time a user starts a session they must go through ... user to 'Remember Me' using a checkbox and persisting the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Questions About Session Timeout
    ... The IIS config will handle the session state, and the forms auth will handle the authentication cookie. ... This is what the auth cookie lifetime is for, which you set in the forms auth section of the web.config. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: FormsAuthentication
    ... It should be only one cookie per Forms session. ... RedirectFromLoginPage function and the you might have an old persistent ... > I am setting the Forms authentication cookie by using: ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Sessions vs Cookies
    ... There is a session cookie which simply allows the server to identify the client and retrieve relevant session data for it. ... If cookies can be read or forged, it makes little odds whether you have the master key or all the little keys,. ... Suppose you only send the PHPSESSID: Now you cannot change a thing on the server, even if you have the 'master key'. ...
    (comp.lang.php)