How to get log-in name from cookie in case of Forms authentication?

I am using 'System.Web.Security.Membership' &
'System.Web.UI.WebControls.Login' control to implement Forms based
authentication. The problem began after I started persisting the
credentials using cookie. On the first log-in credentials of user, say
'account1', gets persisted in a cookie; and after this 'account1' is
able to access the resource owned by another other user 'account2'.
Please help me resolve this or rather clarify my understanding.

Here are the details of my implementation. Authentication is done by
comparing user name and password against the values stored in DB; and
thus MembershipProvider authenticates against the DB. And the files or
data belonging to an user is kept in a folder who's name is same as
account name; and the logged in user is given access to the files if
the log-in name is same as folder name. Account name is not passed as
part of URL and but picked up from the log-in dialog. Server compares
log-in against folder name to decide whether to give access to the
files. Here is the sample URL
http://localhost:8080/?id=572

Before I added the cookie feature, user was being prompted for
credentials every time and this setup was working fine. And the
problem started after I added the cookies. I have overloaded only
System.Web.UI.WebControls.Login::OnAuthenticate() and here it is

System.Web.UI.WebControls.Login::OnAuthenticate( o, e)
{
if(MembershipProvider.Validate(u,p))
{
FormAuthenticate::RedirectFromLoginPage(u, true)
e.Authenticated = true;
}
else
{
e.Authenticated = false;
}
}

What I am seeing is that MembershipProvider.Validate() gets called
only on the first log-in but not on subsequent times. I would like to
know how .Net framework compensates for not invoking
MembershipProvider.Validate(). And, I can see the problem in that on
subsequent log-ins I am not storing log-in name; and the solution
seems to be that some how I should get the log-in name that is present
inside the cookie.

So my questions are..
-Is my understanding correct?
-On subsequent logins, will any methods of
System.Web.UI.WebControls.Login() gets called at all?
If so, which method should I overload to get the log-in name?

Thanks in advance
Ramesh
.

Relevant Pages

  • Newbie question: how to save user id on users computer
    ... I would like to give a registered user of my website the option to ... next time he goes to the log-in page. ... how do I get the userid from the cookie into the ...
    (comp.lang.php)
  • Re: Newbie question: how to save user id on users computer
    ... > I would like to give a registered user of my website the option to ... > next time he goes to the log-in page. ... > a cookie. ...
    (comp.lang.php)
  • FormsCookieName
    ... Somwhere on Internet I saw this example how to create and log-in the new user: ... c/ Response.Redirect("some url within app") ... I don't understand the line b/ why it is needed to remove the default cookie ... Do I need to set up FormsCookieName property to unique value for every new ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Newbie question: how to save user id on users computer
    ... Nevermind... ... I want to write the cookie only after the user has ... >successfully logged-in. ... >>next time he goes to the log-in page. ...
    (comp.lang.php)
  • Re: open ldap authentication without redundant log-in
    ... I advised against carrying the log-in across apps. ... >> could build an authentication mechanism that uses an existing set ... > the browser and point it at your web server the web server has no way ... > You should always re-authenticate across applications. ...
    (comp.lang.php)