Re: forms authentication cookie changes

From: Andy Fish (ajfish_at_blueyonder.co.uk)
Date: 07/22/05

  • Next message: MilanB: "Security question?" 
    Date: Fri, 22 Jul 2005 09:08:11 +0100

    Thanks Dominick.

    I knew it re-sent the cookie after half the timeout but I didn't realise it
    would generate a new one.

    "Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com>
    wrote in message news:628051632575660210169952@news.microsoft.com...
    > Hello Andy,
    >
    > FormsAuth issues a new cookie after timeout/2. That's the behaviour when
    > you have sliding expiration enabled.
    >
    > ---------------------------------------
    > Dominick Baier - DevelopMentor
    > http://www.leastprivilege.com
    >
    >> Hi all,
    >>
    >> For reasons I would rather not go into, I sometimes need to get the
    >> value of the forms authentication cookie and use it later when
    >> submitting another request to the server.
    >>
    >> mostly this works fine but sometimes it seems that the server decides
    >> to change the forms authentication cookie (in contrast to the session
    >> cookie which stays the same the whole time the session is in
    >> existence).
    >>
    >> note that this is not happening because the authentication timeout has
    >> expired. I am still logged on as the same user and have the same
    >> session; it's just that the cookie value has changed.
    >>
    >> Can anyone explain why and how this happens, and if there is any way I
    >> can control (or disable) this behaviour?
    >>
    >> TIA
    >>
    >> Andy
    >>
    >
    >
    >

  • Next message: MilanB: "Security question?"

    Relevant Pages

    • Re: forms authentication question
      ... I have 20 minute timeout on the session key. ... the forms authentication cookie, but I really would like to keep both the ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Authentication question
      ... I also found the settings and chose to set a sliding timeout for the ... complained about having to login when I knew their session had not expired. ... > The session timeout and forms authentication cookie timeout are ... > authentication cookie but all of the inproc session state is gone. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Persistent Cookies
      ... Yes I know that they arent used for session management. ... happen was the framework itself had set the timeout for a persistent cookie ... set the timeout for persistent cookies in our configuration. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: forms authentication question
      ... sliding timeout or absolute timeout, but my problem is that the ... sliding expiration does not get updated all the time. ... So, if I set the sliding expiration to 20 minutes, the cookie will be updated after 10 minutes, and if the user did something in the first 10 minutes, but then didn't do anything for the next 15 minutes, forms authentication cookie will be timed-out. ... Storing custom session key in the cookie gives me an ability to renew the cookie as long as the session key has not expired. ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: forms authentication question
      ... I can increase the timeout on the forms authentication cookie, but I really would like to keep both the session key and the forms authentication cookie close to each other if possible. ...
      (microsoft.public.dotnet.framework.aspnet.security)