Question about forms authentication in asp.net

Question

I need to secure the pages of an e-commerce website using forms authentication and there's a client requirement that in the login form there would be the "Remember Me" check box that when clicked will keep the user logged in for a month, else he'll have to login each time he visits the site. How can I do this with forms authentication?

Also I am confused about the parameter "createPersistentCookie" of the methods "RedirectFromLoginPage" or "SetAuthCookie", if set to true, it will create a persistent cookie. Persistent for how long?

Thanks

turtlepick · Accepted Answer · 2010-12-27 15:42:07Z

1

You specify the timeout of the cookie in the web.config:

<forms 
   name="name" 
   loginUrl="URL" 
   defaultUrl="URL"
   protection="[All|None|Encryption|Validation]"
   timeout="[MM]"
   path="path"
   requireSSL="[true|false]"
   slidingExpiration="[true|false]">
   enableCrossAppRedirects="[true|false]"
   cookieless="[UseUri|UseCookies|AutoDetect|UseDeviceProfile]" 
   domain="domain name"
   ticketCompatibilityMode="[Framework20|Framework40]">
   <credentials>...</credentials>
</forms>

http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

http://weblogs.asp.net/scottgu/archive/2005/11/08/430011.aspx

If you just want to set the cookie (Authenticate the user) and do your own redirect use the SetAuthCookie with the "true" parameter.

answered Dec 27, 2010 at 15:42

turtlepick

2,71223 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Yasmine Over a year ago

I still don't understand how would I differentiate between the user who checks "Remember Me" so that he'll be kept logged in for 1 month and the user who won't check "Remember Me". If I changed the timeout value in the webconfig to 43200 i.e 30 days it will apply for both users.

turtlepick Over a year ago

If you pass the parameter as "false" the cookie will be a SessionCookie so when the user closes the browser it will be gone.

Yasmine Over a year ago

I found this post forums.asp.net/t/1010241.aspx, what I understood from it, is that it's not possible to differentiate between persistent and non persistent cookies using forms authentication and setting the timeout for a large value affects performance. Is this true or I got it wrong?

turtlepick Over a year ago

I just tested adding "5000" and using firebug it shows as a Session Cookie (as expected), meaning after you close your browser it will go away (it might persist if you close the tab and use another tab)

turtlepick Over a year ago

I wouldn't think so... Cookies are client things so they won't affect server side performance. The problem will be mostly the Session Timeout (that affects performance). As for security, cookies can be "hijacked" (if I copy your cookies to my PC I can impersonate you). That's something you have to be aware of. Example: eweek.com/c/a/Security/…

gbs · Accepted Answer · 2010-12-27 18:15:38Z

0

Instead of relying on SetAuthCookie or RedirectFromLogin page you can create the FormsAuthenticationTicket and the cookie explicitly. Here you have control over the timeout of cookie as well as ticket.

FormsAuthenticationTicket Class

Also check this.

answered Dec 27, 2010 at 18:15

gbs

7,2665 gold badges47 silver badges70 bronze badges

Collectives™ on Stack Overflow

Question about forms authentication in asp.net

2 Answers 2

5 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related