RE: Reconnect to a session and authenticate.

Steven,

The solution I posted did not work in all cases. I used the custom session
Id manager in the link.

Now the question is how do I restore the authentication without sending the
user name in the Qstring. I do store the forms auth cookie in the query
string. How do I use it the authenticate.

Thank you
--
Jerry


""Steven Cheng"" wrote:

Hi Jerry,

From your description, I understand you want to programmatically restore a
certain session connection or forms authentication connection in your code
(by supplying the sessionID or authentication info) , correct?

Based on my understanding, for forms authentication, it is quite easy to
regenerate the authentication state, you can simply call the following
method to make the current user be authenticated again(supply the username):

FormsAuthentication.SetAuthCookie(username, true);

However, for session state, it is always done(validate client cookie) by
the built-in session state module. If you put the session state info(such
as ID) in querystring, runtime will not know it. You can try manually add
the cookie (that contain the sessionID you previously stored) into ASP.NET
response.

If this not work, you may have a look at creating a custom
SessionIDManager, that can help you add your own code logic to read and
generate sessionID:

#Overcoming IE Bug with a Custom SessionIDManager
http://blogs.microsoft.co.il/blogs/dorony/

#SessionIDManager Class
http://msdn2.microsoft.com/en-us/library/system.web.sessionstate.sessionidma
nager(VS.80).aspx

#ASP.NET 2.0 Training : Customizing the Session State Mechanism
http://www.exforsys.com/tutorials/asp.net-2.0/asp.net-2.0-customizing-the-se
ssion-state-mechanism.html

Hope this helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



==================================================

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.



Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: =?Utf-8?B?SmVycnkgQw==?= <jerryed@xxxxxxxxxxxxx>
Subject: Reconnect to a session and authenticate.
Date: Mon, 3 Mar 2008 14:43:01 -0800



I have an asp.net application using forms authentication. On one of my
pages
I use a control that does not return the cookies in firefox. (the creator
of
the control will remain nameless) I can include the session cookie
"ASP.NET_SessionId" and the cookie “CD�placed by the forms
authentication in
the querystring. The Question is how do I reconnect to the session and
reauthenticate when this page posts back so my session vars are there.

--
Jerry



.

Relevant Pages

  • Runtime error when customErrors are Off
    ... "On" Always display custom messages. ... This section sets the authentication policies of the application. ... Application-level tracing enables trace log output for every page ... <!-- SESSION STATE SETTINGS ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: HELP Connection error on Release mode
    ... "Off" Always display detailed ASP.NET error information. ... This section sets the authentication policies of the application. ... Set trace enabled="true" to enable application trace logging. ... <!-- SESSION STATE SETTINGS ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Session Fixation Vulnerability in Web-based Applications
    ... session, without modifying the way servers generate session ID's is as ... Think of the http server generated sessions as "UI Sessions" and as ... no impact on authentication. ... "authentication key" for this domain (usually in the form of a new ...
    (NT-Bugtraq)
  • RE: Reconnect to a session and authenticate.
    ... I solved this problem by adding the cookies and doing a server transfer. ... certain session connection or forms authentication connection in your code ... However, for session state, it is always doneby ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Reconnect to a session and authenticate.
    ... what you need to do is just store the username in a custom cookie item. ... I used the custom session ... Based on my understanding, for forms authentication, it is quite easy to ...
    (microsoft.public.dotnet.framework.aspnet.security)