473,394 Members | 1,879 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,394 software developers and data experts.

Forms Authentication - Not timing out, not redirecting.

Hi,
I've come across this scenario in ASP.NET 1.1 with forms authentication
where the forms auth doesn't seem to timeout correctly, nor redirect to the
login page.

I have done some testing, and I believe I've found a solution, but I
would like some insight from Microsoft on whether the code I've implemented
is correct, and why it is even working.

Here is my scenario:

I initially implemented forms auth using the standard forms auth
declaration in web.config and it worked fine, and redirected alright. Then,
as I began going through my code during my security reviews I implemented
the encrypted auth ticket as described in the "Building Secure ASP.NET
Applications" on page 378 (document page number, not the PDF page number).
In this scenario, it describes how to build the login event from the login
page, as well as implementing the "Application_AuthenticateRequest" event in
the global.asax code.

Once I implemented that code, my forms auth stopped working. The ticket
was still valid after my timeout, and I was never redirected to the
specified login page. I was implementing SessionState with the same timeout
as the formsauth, and my session was timing out properly! I was also using
a non-persistent formsauth cookie. After going back over the documentation
several many times, and making sure I was implementing it as described, I
believe I found a problem with the code in the document. However, I don't
want to go as far as saying the code is wrong, but I've come up with a fix
that makes it work - but now I don't understand exactly why it fixes it.

Basically in Application_AuthenticateRequest, once the ticket is
decrypted from the cookie the code checks whether the ticket is null to
determine if there was one available. If it is, return. After that, it
extracts the roles, and sets up the HttpContext user identity information.
All fine and dandy. However, nobody checks whether the authTicket has
actually expired yet! So, immediately after the null=authTicket check, I
inserted a check whether the authTicket had expired, and it now works.

I understand sort-of why this works, but then I decided to go in with
Reflector and look at the FormsAuthenticationModule class and look at it's
"OnAuthenticate" event. In there, the framework checks whether it is
expired, et. al., exactly like I made my code do in Global.asax.

After doing some further research on the ASP.NET HTTP Pipeline, I see
that the application gets the pipeline call first, and passes it on to it's
modules. Then I read that global.asax's Authenticate_Request is called by
the security module that is in place - which in this case is the
FormsAuthenticationModule. Now if the FormsAuthenticationModule is doing
it's check, and then passing it onto my global.asax Authenticate_Request
code - wouldn't FormsAuthModule already have figured out the ticket was
expired and done something about it?

Or is it the fact that since I have implemented
Application_AuthenticateRequest - that my code then has some sort of
precedence?

My guess is this: Since the COOKIE is actually a non-persistent cookie,
it is valid while the browser is open. Thus, this entire time the cookie is
actually there, just not expired. Then in the
Application_AuthenticateRequest code, the authTicket is always extracted
(because we have a browser cookie full of encrypted data). But at the
FormsAuthentication level, which we're really concerned about, the
authTicket has expired - which is a separate expiration from the actual
cookie expiration. But nobody is checking for that. Thus, I get the
authTicket out of the cookie every time, and then fill the Identity object
on the current HttpContext every time. Even if it has really expired. So
when I place the additional check for expiration in there, it works as it is
supposed to.

I am glad the code works - but I'm primarily confused as to the why.
Was there a reason that the "Building Secure ASP.NET Applications" article
presented the code as it did? Or did I really find a bug in that code? I
guess I'm fairly concerned if the code is incomplete - the document has been
out for some time? Am I the first to run across this?

Additional question: Do I also need to conditionally update my
slidingTimeout in this code as well to match the FormsAuthenticationModule
"OnAuthenticate" code? Or will something else do this for me? From my
testing, it appears to be renewed for me, but I wanted to make sure this
wasn't some sort of fluke as well.

Here is my Application_AuthenticateRequest code:

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{

string cookieName = FormsAuthentication.FormsCookieName;

HttpCookie authCookie = Context.Request.Cookies[ cookieName ];

if( null == authCookie ) {

return;

}

FormsAuthenticationTicket authTicket = null;

try {

authTicket = FormsAuthentication.Decrypt( authCookie.Value );

}

catch( Exception ex ) {

AppHelper.LogEvent( ex.ToString(), 3 );

return;

}

if( (null == authTicket) || authTicket.Expired ) {

return;

}

string[] roles = authTicket.UserData.Split( new char[]{'|'} );

FormsIdentity id = new FormsIdentity( authTicket );

GenericPrincipal principal = new GenericPrincipal( id, roles );

Context.User = principal;

}
Nov 18 '05 #1
1 2171
Am I supposed to be hearing back from a Microsoft person on this within 2
business days using the MSDN Universal newsgroup MSDN stuff?

"AVance" <Aa***@noemail.nospam> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...
Hi,
I've come across this scenario in ASP.NET 1.1 with forms authentication where the forms auth doesn't seem to timeout correctly, nor redirect to the login page.

I have done some testing, and I believe I've found a solution, but I
would like some insight from Microsoft on whether the code I've implemented is correct, and why it is even working.

Here is my scenario:

I initially implemented forms auth using the standard forms auth
declaration in web.config and it worked fine, and redirected alright. Then, as I began going through my code during my security reviews I implemented
the encrypted auth ticket as described in the "Building Secure ASP.NET
Applications" on page 378 (document page number, not the PDF page number).
In this scenario, it describes how to build the login event from the login
page, as well as implementing the "Application_AuthenticateRequest" event in the global.asax code.

Once I implemented that code, my forms auth stopped working. The ticket was still valid after my timeout, and I was never redirected to the
specified login page. I was implementing SessionState with the same timeout as the formsauth, and my session was timing out properly! I was also using a non-persistent formsauth cookie. After going back over the documentation several many times, and making sure I was implementing it as described, I
believe I found a problem with the code in the document. However, I don't
want to go as far as saying the code is wrong, but I've come up with a fix
that makes it work - but now I don't understand exactly why it fixes it.

Basically in Application_AuthenticateRequest, once the ticket is
decrypted from the cookie the code checks whether the ticket is null to
determine if there was one available. If it is, return. After that, it
extracts the roles, and sets up the HttpContext user identity information.
All fine and dandy. However, nobody checks whether the authTicket has
actually expired yet! So, immediately after the null=authTicket check, I
inserted a check whether the authTicket had expired, and it now works.

I understand sort-of why this works, but then I decided to go in with
Reflector and look at the FormsAuthenticationModule class and look at it's
"OnAuthenticate" event. In there, the framework checks whether it is
expired, et. al., exactly like I made my code do in Global.asax.

After doing some further research on the ASP.NET HTTP Pipeline, I see
that the application gets the pipeline call first, and passes it on to it's modules. Then I read that global.asax's Authenticate_Request is called by
the security module that is in place - which in this case is the
FormsAuthenticationModule. Now if the FormsAuthenticationModule is doing
it's check, and then passing it onto my global.asax Authenticate_Request
code - wouldn't FormsAuthModule already have figured out the ticket was
expired and done something about it?

Or is it the fact that since I have implemented
Application_AuthenticateRequest - that my code then has some sort of
precedence?

My guess is this: Since the COOKIE is actually a non-persistent cookie, it is valid while the browser is open. Thus, this entire time the cookie is actually there, just not expired. Then in the
Application_AuthenticateRequest code, the authTicket is always extracted
(because we have a browser cookie full of encrypted data). But at the
FormsAuthentication level, which we're really concerned about, the
authTicket has expired - which is a separate expiration from the actual
cookie expiration. But nobody is checking for that. Thus, I get the
authTicket out of the cookie every time, and then fill the Identity object
on the current HttpContext every time. Even if it has really expired. So
when I place the additional check for expiration in there, it works as it is supposed to.

I am glad the code works - but I'm primarily confused as to the why.
Was there a reason that the "Building Secure ASP.NET Applications" article
presented the code as it did? Or did I really find a bug in that code? I
guess I'm fairly concerned if the code is incomplete - the document has been out for some time? Am I the first to run across this?

Additional question: Do I also need to conditionally update my
slidingTimeout in this code as well to match the FormsAuthenticationModule
"OnAuthenticate" code? Or will something else do this for me? From my
testing, it appears to be renewed for me, but I wanted to make sure this
wasn't some sort of fluke as well.

Here is my Application_AuthenticateRequest code:

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{

string cookieName = FormsAuthentication.FormsCookieName;

HttpCookie authCookie = Context.Request.Cookies[ cookieName ];

if( null == authCookie ) {

return;

}

FormsAuthenticationTicket authTicket = null;

try {

authTicket = FormsAuthentication.Decrypt( authCookie.Value );

}

catch( Exception ex ) {

AppHelper.LogEvent( ex.ToString(), 3 );

return;

}

if( (null == authTicket) || authTicket.Expired ) {

return;

}

string[] roles = authTicket.UserData.Split( new char[]{'|'} );

FormsIdentity id = new FormsIdentity( authTicket );

GenericPrincipal principal = new GenericPrincipal( id, roles );

Context.User = principal;

}

Nov 18 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

1
by: Stu | last post by:
Hi All, I have an ASP.NET application to which I have implemented forms authentication to handle security. It is a relatively straight forward solution with all aspx pages residing in the root...
11
by: ElmoWatson | last post by:
I tried on the Security newgroup, as well as other places, and haven't gotten an answer yet - - I'm pulling my hair out over this one. I'm trying to get Forms Authentication working.....I can get...
2
by: VR | last post by:
Hi, I am using Forms type of authentication, but having problems redirecting users to default page after they get authenticated. My default page is default.aspx, but it's in 'public'...
0
by: Ed Henn | last post by:
I'm having a problem with .NET Forms Authentication in a particular application. It's not redirecting properly when my session is timed out, seemingly only when I POST the page (i.e. click a form...
0
by: Steve - DND | last post by:
I have the following information set in my web.config file: <authentication mode="Forms"> <forms loginUrl="Login.aspx" name="formAuthCookie" timeout="60" path="/"/> </authentication> ...
0
by: Anonieko Ramos | last post by:
ASP.NET Forms Authentication Best Practices Dr. Dobb's Journal February 2004 Protecting user information is critical By Douglas Reilly Douglas is the author of Designing Microsoft ASP.NET...
0
by: Pradeep Pise | last post by:
Hello All, I have a problem in my project. I have used forms authentication and code is embedded in web.config. <authentication mode="Forms"> <forms name="AuthCookie" path="/"...
7
by: Rob | last post by:
I'm not sure if I'm missing something but my forms authentication doesn't work. I'm trying to access my page and I should be redirected to login.aspx but it just let's me access the page. Here's...
1
by: Jeremy | last post by:
I have a web app that contains forms authentication to protect subdirectory called "admin" by denying anonymous users. When I request a protected resource in the admin directory I am presented with...
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.