ASP.NET: Authenticating user in code

Question

I'm playing around with authentication and authorization to prepare for some task. I've created two pages: Login.aspx and Default.aspx. In config file i've set authentication to forms and denied unauthenticated users access:

<authentication mode="Forms">
      <forms name="aaa" defaultUrl="~/Login.aspx" />
    </authentication>
    <authorization>
      <deny users="?"/>
    </authorization>

Then I've written some simple code to authenticate my user in Login.aspx:

protected void Page_Load(object sender, EventArgs e)
        {
            GenericIdentity identity = new GenericIdentity("aga", "bbb");
            Context.User = new GenericPrincipal(identity, new String[] { "User" }); ;
            Response.Redirect("~/Default.aspx");
        }

When i run it, the redirection doesn't take place. Instead Login.aspx is called over and over because the user is not authenticated (Context.User.Identity.IsAuthenticated is false at every load). What am i doing wrong?

Rex M · Accepted Answer · 2009-09-17 16:15:24Z

7

Context.User only sets the principal for the current request. Once the redirect takes place, the current request ends and a new one begins with the non-overridden principal again (which is apparently not authenticated). So, setting Context.User doesn't actually authenticate anything.

Using FormsAuthentication.SetAuthCookie() will set the user's cookie to a valid value accepted by the FormsAuthentication provider, or put the token in the URL. You can redirect to your heart's content because the cookie obviously sticks with the user for future requests.

From MSDN (em added):

With forms authentication, you can use the SetAuthCookie method when you want to authenticate a user but still retain control of the navigation with redirects.

As stated, this does not necessarily require cookies - the name is a little misleading, because it will still work via the URL if FormsAuthentication is in cookieless mode:

The SetAuthCookie method adds a forms-authentication ticket to either the cookies collection, or to the URL if CookiesSupported is false.

edited Sep 17, 2009 at 16:15

answered Sep 17, 2009 at 16:01

Rex M

144k34 gold badges292 silver badges315 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Chris Ballance Over a year ago

Server.Transfer instead of Response.Redirect should correct this problem.

Rex M Over a year ago

@Chris only for the current request - just delays the problem till the next request.

mxmissile · Accepted Answer · 2009-09-17 16:02:19Z

4

Use FormsAuthentication.SetAuthCookie(..). Or FormsAuthentication.RedirectFromLoginPage(..).

answered Sep 17, 2009 at 16:02

mxmissile

11.7k6 gold badges57 silver badges85 bronze badges

Comments

Jarrett Meyer · Accepted Answer · 2009-09-17 16:04:14Z

1

You need to actually set the user as authenticated. All of the following methods will work and let you actually get away from your login screen.

FormsAuthentication.Authenticate()
FormsAuthentication.RedirectFromLoginPage()
FormsAuthentication.SetAuthCookie()

Lots of ways to get to the same result.

answered Sep 17, 2009 at 16:04

Jarrett Meyer

19.6k6 gold badges61 silver badges52 bronze badges

Comments

Mitchel Sellers · Accepted Answer · 2009-09-17 16:00:02Z

0

You need to actually make a call to the formsAuthentication provider to set the login.

FormsAuthentication.RedirectFromLoginPage(txtUser.Text, chkPersistLogin.Checked)

is a simple example

answered Sep 17, 2009 at 16:00

Mitchel Sellers

63.3k15 gold badges115 silver badges174 bronze badges

1 Comment

agnieszka Over a year ago

and if i wouldn't like the user to be redirected? i just want to know how to authenticate him

o.k.w · Accepted Answer · 2009-09-17 16:02:12Z

0

After creating the dummy Context.User, you need to perform a FormsAuthentication.SetAuthCookie or RedirectFromLoginPage method.

answered Sep 17, 2009 at 16:02

o.k.w

25.9k6 gold badges68 silver badges64 bronze badges

Collectives™ on Stack Overflow

ASP.NET: Authenticating user in code

5 Answers 5

2 Comments

Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related