Hi,
I noticed weird behaviour with the site that is using forms
authentication. I am logged to the site from the same machine from two
browsers (opened separately, not ctrl-N) as different users so two
sessions are created. Then from the one window I logoff but I'm
automatically logouted also from the other browser window. Why?
It is strange that it is working OK if I'm doing it on the same machine
where the web server is located.
regards,
mircu
7  1743 
If you did a ctrl-N, then they are part of the same session and I would
imaging so is the user logged in.
"mircu" <mi***@op.pl> wrote in message
news:%2******** *******@TK2MSFT NGP10.phx.gbl.. . Hi,
I noticed weird behaviour with the site that is using forms
authentication. I am logged to the site from the same machine from two
browsers (opened separately, not ctrl-N) as different users so two
sessions are created. Then from the one window I logoff but I'm
automatically logouted also from the other browser window. Why?
It is strange that it is working OK if I'm doing it on the same machine
where the web server is located.
regards,
mircu
Peter Rilling wrote: If you did a ctrl-N, then they are part of the same session and I would
imaging so is the user logged in.
A noted in my post that the other browser window was _not_ opened with
ctrl-N. I know that then it would be the same session.
regards,
mircu
Maybe I'm being thick, but what have sessions to do with forms
authentication. Isn't the auth token saved as a cookie. And the cookie is
shared.
Try using two different browsers rather than two instances of the same
browser type.
BTW, isn't the displayed functionality the desired case? That users remain
logged in at the server even if their browser is restarted/doubly launched.
As stated above, I could be a bit thick.
"mircu" <mi***@op.pl> wrote in message
news:OE******** ******@TK2MSFTN GP12.phx.gbl... Peter Rilling wrote: If you did a ctrl-N, then they are part of the same session and I would
imaging so is the user logged in.
A noted in my post that the other browser window was _not_ opened with
ctrl-N. I know that then it would be the same session.
regards,
mircu
KMA wrote: Maybe I'm being thick, but what have sessions to do with forms
authentication. Isn't the auth token saved as a cookie. And the cookie is
shared.
You are right that sessions and form authentication are separated
things. In my application I have tied it together a little. When the
user is logging I create the auth cookie and add to the response. When
logging out the FormsAuthentica tion.SignOut() and Session.Abandon () are
called.
Try using two different browsers rather than two instances of the same
browser type.
OK. I've checked this: when I'm connecting from two IE browsers it _is
not OK_, when from two Firefox browsers also _not OK_, but when from one
IE and one Firefox it _is OK_.
Hmm, maybe the auth cookie is shared across the browsers (the same type).
BTW Is there a way to list all cookies stored in memory?
BTW, isn't the displayed functionality the desired case? That users remain
logged in at the server even if their browser is restarted/doubly launched.
When the server is restarted sessions are lost (I have to use in-proc
sessions) so users can not continue work after the server is restarted
and should login again.
As stated above, I could be a bit thick.
"mircu" <mi***@op.pl> wrote in message
news:OE******** ******@TK2MSFTN GP12.phx.gbl...
Peter Rilling wrote:
If you did a ctrl-N, then they are part of the same session and I would
imaging so is the user logged in.
A noted in my post that the other browser window was _not_ opened with
ctrl-N. I know that then it would be the same session.
regards,
mircu
regards,
mircu
Mircu,
I'm still a bit puzzled as to why you think the observed behaviour is
incorrect. If I launch two instances of the same browser then they share the
same (client-side stored) cookie. If I log on in one then I'm effectively
logged on in the other. The "browser type cookie is logged on", you might
say. When the server is restarted sessions are lost (I have to use in-proc
sessions) so users can not continue work after the server is restarted
and should login again.
But this is true regardless of how many client browsers are open. In-proc
storage on the server side is held only as long as the server process
exists. But the client side cookie may still be valid and authenticated.
This is also the desirted model, is it not? If I'm logged in to Amazon and
I'm taking 10 minutes to decide whther to buy a book, during which time
Amazon servers restart, why should I be prompted to log in again?
However, if you are personally storing something in a session volatile way
and the sessions are lost through a restart, it is up to you to write that
data to pernanent storage beforehand and recover it after. But I don't see
how the Forms authentication model is to blame here.
KMA
"mircu" <mi***@op.pl> wrote in message
news:uj******** ******@TK2MSFTN GP12.phx.gbl... KMA wrote: Maybe I'm being thick, but what have sessions to do with forms
authentication. Isn't the auth token saved as a cookie. And the cookie
is shared. You are right that sessions and form authentication are separated
things. In my application I have tied it together a little. When the
user is logging I create the auth cookie and add to the response. When
logging out the FormsAuthentica tion.SignOut() and Session.Abandon () are
called.
Try using two different browsers rather than two instances of the same
browser type.
OK. I've checked this: when I'm connecting from two IE browsers it _is
not OK_, when from two Firefox browsers also _not OK_, but when from one
IE and one Firefox it _is OK_.
Hmm, maybe the auth cookie is shared across the browsers (the same type).
BTW Is there a way to list all cookies stored in memory?
BTW, isn't the displayed functionality the desired case? That users
remain logged in at the server even if their browser is restarted/doubly
launched.
When the server is restarted sessions are lost (I have to use in-proc
sessions) so users can not continue work after the server is restarted
and should login again.
As stated above, I could be a bit thick.
"mircu" <mi***@op.pl> wrote in message
news:OE******** ******@TK2MSFTN GP12.phx.gbl...
Peter Rilling wrote:
If you did a ctrl-N, then they are part of the same session and I would
imaging so is the user logged in.
A noted in my post that the other browser window was _not_ opened with
ctrl-N. I know that then it would be the same session.
regards,
mircu
regards,
mircu
KMA wrote: I'm still a bit puzzled as to why you think the observed behaviour is
incorrect. If I launch two instances of the same browser then they share the
same (client-side stored) cookie. If I log on in one then I'm effectively
logged on in the other. The "browser type cookie is logged on", you might
say.
I know that this behaviour can be correct in one situation but it is not
correct in another. In my situation I'd like to log in in one browser
with different role than in another. If I'm logged in one browser, then
if I am automatically authorized to the site from other browsers I can
not log in as a different user with different role.
However, if you are personally storing something in a session volatile way
and the sessions are lost through a restart, it is up to you to write that
data to pernanent storage beforehand and recover it after. But I don't see
how the Forms authentication model is to blame here.
I blame it that it doesn't work in the situation I described earlier. I
agree that in one situation the behaviour is correct but if I wanted
something other it seems that it can't be customized. The fix would be
simple, the cookie name or data should be allowed to append user defined
data (eg. user name/role/id) and then if I wanted to log in from two
browsers I would have two cookies and when logging off only one cookie
(matched the defined data) should be deleted.
regards,
mircu
Mircu,
I think it's true to say that logging in simultaneously with two different
sets of credentials is an exotic requirement, and hence it isn't the default
behaviour of forms authentication. As far as I can imagine, the only reason
to do this is for testing a site. You could do this by lauching multiple
browser types. If you really want to use the same browser, or your users
need to then you're going to have to handroll some extra authentication
code. Either way, I think the plain vanilla forms auth gives you incredible
functionality for the 20 or so lines it take to implement.
KMA
"mircu" <mi***@op.pl> wrote in message
news:#N******** ******@TK2MSFTN GP09.phx.gbl... KMA wrote: I'm still a bit puzzled as to why you think the observed behaviour is
incorrect. If I launch two instances of the same browser then they share
the same (client-side stored) cookie. If I log on in one then I'm
effectively logged on in the other. The "browser type cookie is logged on", you
might say.
I know that this behaviour can be correct in one situation but it is not
correct in another. In my situation I'd like to log in in one browser
with different role than in another. If I'm logged in one browser, then
if I am automatically authorized to the site from other browsers I can
not log in as a different user with different role.
However, if you are personally storing something in a session volatile
way and the sessions are lost through a restart, it is up to you to write
that data to pernanent storage beforehand and recover it after. But I don't
see how the Forms authentication model is to blame here.
I blame it that it doesn't work in the situation I described earlier. I
agree that in one situation the behaviour is correct but if I wanted
something other it seems that it can't be customized. The fix would be
simple, the cookie name or data should be allowed to append user defined
data (eg. user name/role/id) and then if I wanted to log in from two
browsers I would have two cookies and when logging off only one cookie
(matched the defined data) should be deleted.
regards,
mircu This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics | |
by: Billy Jacobs |
last post by:
I have a website which has both secure and non-secure
pages. I want to uses forms authentication. How do I
accomplish this?
Originally I had my web.config file in the root with Forms
Authentication set up and it worked just fine. Then I
realized that I needed to have some pages unsecure.
I then created 2 directories. One named Secure and the
other named Public. I placed my web.config file in my
|
by: Kris van der Mast |
last post by:
Hi,
I've created a little site for my sports club. In the root folder there are
pages that are viewable by every anonymous user but at a certain subfolder
my administration pages should be protected by forms authentication.
When I create forms authentication at root level it works but when I move my
code up to the subfolder I get this error:
Server Error in '/TestProjects/FormsAuthenticationTestingArea' Application.
|
by: Eric |
last post by:
I am trying to build an app where the stuff in the root directory is open to
all, but anything under the Restricted directory requires you to login and I
want to use Forms to do it. I'm having trouble getting the web.config to
work properly.
First I tried to have a second web.config in the sub directory with
authentication and authorization set to forms, but it blew up.
Next, I tried to modify the root web.config in the following manner...
|
by: Anonieko Ramos |
last post by:
ASP.NET Forms Authentication Best Practices
Dr. Dobb's Journal February 2004
Protecting user information is critical
By Douglas Reilly
Douglas is the author of Designing Microsoft ASP.NET Applications and
owner of Access Microsystems. Doug can be reached at
doug@accessmicrosystems.com.
--------------------------------------------------------------------------------
|
by: Justin |
last post by:
I am trying to password protect a subdirectory using forms authentication. I
am using the "Location" tag to specify the directory to be protected. The
login.aspx page is in the root directory of the app. Here is the web.config:
<location path="Admin">
<system.web>
<authentication mode="Forms">
<forms name="authAdmin" loginUrl="Login.aspx" protection="All" timeout="30">
<credentials passwordFormat="Clear">
<user name="Admin"...
| | |
by: V. Jenks |
last post by:
Using forms authentication, can I control which pages
and/or directories a user would have access to or is that
only available with Windows authentication?
Thanks!
|
by: =?Utf-8?B?R3V1czEyMw==?= |
last post by:
Hi,
I created a web site on a remote server. To logon the user must enter a user
id and password. The site is uses Forms Authentication.
The web config file looks as follows:
<configuration>
<system.web>
<customErrors mode="Off"/>
|
by: Bjorn Sagbakken |
last post by:
In a web-application with login creds (user, pwd), these are checked against
a user table on a SQL server. On a positive validation I have saved the
userID, name, custno and role-settings in a userobject (custom build class)
and added this to the session using as session variable like session
For all other pages I have added a small test in the page_load event,
basically testing if the session != null, but also checking if the...
|
by: Rory Becker |
last post by:
Having now created a Custom MembershipProvider that seems to work correctly
with my Logon and ChangePassword controls, I am, as they say, a happy bunny.
The next stange is to move on to the creation of content which adjusts based
on the user.
I have several pages which require a user to be logged on and several which
do not. Prior to this point in time I have used 2 different master pages.
one with a control which checks a session...
|
by: Sean |
last post by:
Hi, I've taken over a website, which has an admin section that is
currently open. I added Forms Authentication to the admin directory
with the using the location section in web.config:
<location path="admin">
<system.web>
<customErrors mode="Off"/>
<authentication mode="Forms">
<forms name=".COOKIEDEMO" loginUrl="login.aspx"
protection="All" timeout="60" path="/">
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look !
Part I. Meaning of...
| | |
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
|
by: Hystou |
last post by:
Overview:
Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own....
Now, this would greatly impact the work of software developers. The idea...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: adsilva |
last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
| | |
by: 6302768590 |
last post by:
Hai team
i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
|
by: bsmnconsultancy |
last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...
| |
