Using useuri with security: Keep returning to login page

From: Peter Vogel (peter.vogel_at_phvis.com)
Date: 10/24/05 

Date: 23 Oct 2005 17:31:43 -0700

I've tried turning off cookies in FireFox and turning on cookieless
sessions in the forms element inside the authentication element (I set
the cookieless attribute to UseUri). I'm generating the security token
in the URL F(guid).

I can log on successfully and get to the second page in my application
(the page after the login page). However, when I attempt to request
another page (by, for instance, clicking on one of the links in the
Menu control), I find myself right back at the login page with the
query string set to the page that I requested. Sure enough if I log on
again, I find myself at the requested page.

I suspect that this is related to a problem that I'm having with
cookieless sessions. When I set the cookieless attribute in the
sessionState attribute to UseUri, the SessionId in the address bad
seems to keep changing. As a result, I can't reconnect to the data that
I've put in my Session object. In other words, I'll login and, in the
address bar, I'll see S(someguid). After clicking a link to go to
another page I'll see S(someotherguid).

Any thoughts?
  Or
Help!

Relevant Pages

  • Re: Major security issue?
    ... that make your car an insecure product? ... There is, real sessions, although that is arguable as well. ... > problematic since ASP first came about. ... Cookieless sessions are just an alternative. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Going sessionless (and cookie limitations)
    ... The sticky sessions will ensure the same web user reaches the same ... server in the web farm so the reconnect with the same session. ... Most decent load balancer hardware supports sticky sessions. ... cookieless mode, I learned it is best to avoid it whenever possible. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Cookieless Sessions (Sessions Without Cookies) and Security
    ... If someone can sniff your connection (no SSL) - there is no difference between cookies and cookieless security-wise. ... Some suggest that SSL is the cure all for cookieless sessions. ... or at least make them as secure as sessions with cookies? ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Role-based authentication and Forms and System.UnauthorizedAccessException
    ... yes - you can now do cookieless forms authentication, ... sessions, the authentication ticket gets mangled in the URL. ... >> Hello wrecker, ...
    (microsoft.public.dotnet.framework.aspnet.security)