Hi,
I've come across this scenario in ASP.NET 1.1 with forms authentication
where the forms auth doesn't seem to timeout correctly, nor redirect to the
login page.
I have done some testing, and I believe I've found a solution, but I
would like some insight from Microsoft on whether the code I've implemented
is correct, and why it is even working.
Here is my scenario:
I initially implemented forms auth using the standard forms auth
declaration in web.config and it worked fine, and redirected alright. Then,
as I began going through my code during my security reviews I implemented
the encrypted auth ticket as described in the "Building Secure ASP.NET
Applications" on page 378 (document page number, not the PDF page number).
In this scenario, it describes how to build the login event from the login
page, as well as implementing the "Application_AuthenticateRequest" event in
the global.asax code.
Once I implemented that code, my forms auth stopped working. The ticket
was still valid after my timeout, and I was never redirected to the
specified login page. I was implementing SessionState with the same timeout
as the formsauth, and my session was timing out properly! I was also using
a non-persistent formsauth cookie. After going back over the documentation
several many times, and making sure I was implementing it as described, I
believe I found a problem with the code in the document. However, I don't
want to go as far as saying the code is wrong, but I've come up with a fix
that makes it work - but now I don't understand exactly why it fixes it.
Basically in Application_AuthenticateRequest, once the ticket is
decrypted from the cookie the code checks whether the ticket is null to
determine if there was one available. If it is, return. After that, it
extracts the roles, and sets up the HttpContext user identity information.
All fine and dandy. However, nobody checks whether the authTicket has
actually expired yet! So, immediately after the null=authTicket check, I
inserted a check whether the authTicket had expired, and it now works.
I understand sort-of why this works, but then I decided to go in with
Reflector and look at the FormsAuthenticationModule class and look at it's
"OnAuthenticate" event. In there, the framework checks whether it is
expired, et. al., exactly like I made my code do in Global.asax.
After doing some further research on the ASP.NET HTTP Pipeline, I see
that the application gets the pipeline call first, and passes it on to it's
modules. Then I read that global.asax's Authenticate_Request is called by
the security module that is in place - which in this case is the
FormsAuthenticationModule. Now if the FormsAuthenticationModule is doing
it's check, and then passing it onto my global.asax Authenticate_Request
code - wouldn't FormsAuthModule already have figured out the ticket was
expired and done something about it?
Or is it the fact that since I have implemented
Application_AuthenticateRequest - that my code then has some sort of
precedence?
My guess is this: Since the COOKIE is actually a non-persistent cookie,
it is valid while the browser is open. Thus, this entire time the cookie is
actually there, just not expired. Then in the
Application_AuthenticateRequest code, the authTicket is always extracted
(because we have a browser cookie full of encrypted data). But at the
FormsAuthentication level, which we're really concerned about, the
authTicket has expired - which is a separate expiration from the actual
cookie expiration. But nobody is checking for that. Thus, I get the
authTicket out of the cookie every time, and then fill the Identity object
on the current HttpContext every time. Even if it has really expired. So
when I place the additional check for expiration in there, it works as it is
supposed to.
I am glad the code works - but I'm primarily confused as to the why.
Was there a reason that the "Building Secure ASP.NET Applications" article
presented the code as it did? Or did I really find a bug in that code? I
guess I'm fairly concerned if the code is incomplete - the document has been
out for some time? Am I the first to run across this?
Additional question: Do I also need to conditionally update my
slidingTimeout in this code as well to match the FormsAuthenticationModule
"OnAuthenticate" code? Or will something else do this for me? From my
testing, it appears to be renewed for me, but I wanted to make sure this
wasn't some sort of fluke as well.
Here is my Application_AuthenticateRequest code:
protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
string cookieName = FormsAuthentication.FormsCookieName;
HttpCookie authCookie = Context.Request.Cookies[ cookieName ];
if( null == authCookie ) {
return;
}
FormsAuthenticationTicket authTicket = null;
try {
authTicket = FormsAuthentication.Decrypt( authCookie.Value );
}
catch( Exception ex ) {
AppHelper.LogEvent( ex.ToString(), 3 );
return;
}
if( (null == authTicket) || authTicket.Expired ) {
return;
}
string[] roles = authTicket.UserData.Split( new char[]{'|'} );
FormsIdentity id = new FormsIdentity( authTicket );
GenericPrincipal principal = new GenericPrincipal( id, roles );
Context.User = principal;
} 1 2173
Am I supposed to be hearing back from a Microsoft person on this within 2
business days using the MSDN Universal newsgroup MSDN stuff?
"AVance" <Aa***@noemail.nospam> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl... Hi, I've come across this scenario in ASP.NET 1.1 with forms
authentication where the forms auth doesn't seem to timeout correctly, nor redirect to
the login page.
I have done some testing, and I believe I've found a solution, but I would like some insight from Microsoft on whether the code I've
implemented is correct, and why it is even working.
Here is my scenario:
I initially implemented forms auth using the standard forms auth declaration in web.config and it worked fine, and redirected alright.
Then, as I began going through my code during my security reviews I implemented the encrypted auth ticket as described in the "Building Secure ASP.NET Applications" on page 378 (document page number, not the PDF page number). In this scenario, it describes how to build the login event from the login page, as well as implementing the "Application_AuthenticateRequest" event
in the global.asax code.
Once I implemented that code, my forms auth stopped working. The
ticket was still valid after my timeout, and I was never redirected to the specified login page. I was implementing SessionState with the same
timeout as the formsauth, and my session was timing out properly! I was also
using a non-persistent formsauth cookie. After going back over the
documentation several many times, and making sure I was implementing it as described, I believe I found a problem with the code in the document. However, I don't want to go as far as saying the code is wrong, but I've come up with a fix that makes it work - but now I don't understand exactly why it fixes it.
Basically in Application_AuthenticateRequest, once the ticket is decrypted from the cookie the code checks whether the ticket is null to determine if there was one available. If it is, return. After that, it extracts the roles, and sets up the HttpContext user identity information. All fine and dandy. However, nobody checks whether the authTicket has actually expired yet! So, immediately after the null=authTicket check, I inserted a check whether the authTicket had expired, and it now works.
I understand sort-of why this works, but then I decided to go in with Reflector and look at the FormsAuthenticationModule class and look at it's "OnAuthenticate" event. In there, the framework checks whether it is expired, et. al., exactly like I made my code do in Global.asax.
After doing some further research on the ASP.NET HTTP Pipeline, I see that the application gets the pipeline call first, and passes it on to
it's modules. Then I read that global.asax's Authenticate_Request is called by the security module that is in place - which in this case is the FormsAuthenticationModule. Now if the FormsAuthenticationModule is doing it's check, and then passing it onto my global.asax Authenticate_Request code - wouldn't FormsAuthModule already have figured out the ticket was expired and done something about it?
Or is it the fact that since I have implemented Application_AuthenticateRequest - that my code then has some sort of precedence?
My guess is this: Since the COOKIE is actually a non-persistent
cookie, it is valid while the browser is open. Thus, this entire time the cookie
is actually there, just not expired. Then in the Application_AuthenticateRequest code, the authTicket is always extracted (because we have a browser cookie full of encrypted data). But at the FormsAuthentication level, which we're really concerned about, the authTicket has expired - which is a separate expiration from the actual cookie expiration. But nobody is checking for that. Thus, I get the authTicket out of the cookie every time, and then fill the Identity object on the current HttpContext every time. Even if it has really expired. So when I place the additional check for expiration in there, it works as it
is supposed to.
I am glad the code works - but I'm primarily confused as to the why. Was there a reason that the "Building Secure ASP.NET Applications" article presented the code as it did? Or did I really find a bug in that code? I guess I'm fairly concerned if the code is incomplete - the document has
been out for some time? Am I the first to run across this?
Additional question: Do I also need to conditionally update my slidingTimeout in this code as well to match the FormsAuthenticationModule "OnAuthenticate" code? Or will something else do this for me? From my testing, it appears to be renewed for me, but I wanted to make sure this wasn't some sort of fluke as well.
Here is my Application_AuthenticateRequest code:
protected void Application_AuthenticateRequest(Object sender, EventArgs e) {
string cookieName = FormsAuthentication.FormsCookieName;
HttpCookie authCookie = Context.Request.Cookies[ cookieName ];
if( null == authCookie ) {
return;
}
FormsAuthenticationTicket authTicket = null;
try {
authTicket = FormsAuthentication.Decrypt( authCookie.Value );
}
catch( Exception ex ) {
AppHelper.LogEvent( ex.ToString(), 3 );
return;
}
if( (null == authTicket) || authTicket.Expired ) {
return;
}
string[] roles = authTicket.UserData.Split( new char[]{'|'} );
FormsIdentity id = new FormsIdentity( authTicket );
GenericPrincipal principal = new GenericPrincipal( id, roles );
Context.User = principal;
}
This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics
by: Stu |
last post by:
Hi All,
I have an ASP.NET application to which I have implemented forms
authentication to handle security. It is a relatively straight forward
solution with all aspx pages residing in the root...
|
by: ElmoWatson |
last post by:
I tried on the Security newgroup, as well as other places, and haven't
gotten an answer yet - - I'm pulling my hair out over this one.
I'm trying to get Forms Authentication working.....I can get...
|
by: VR |
last post by:
Hi,
I am using Forms type of authentication, but having
problems redirecting users to default page after they get
authenticated.
My default page is default.aspx, but it's in 'public'...
|
by: Ed Henn |
last post by:
I'm having a problem with .NET Forms Authentication in a particular
application. It's not redirecting properly when my session is timed
out, seemingly only when I POST the page (i.e. click a form...
|
by: Steve - DND |
last post by:
I have the following information set in my web.config file:
<authentication mode="Forms">
<forms loginUrl="Login.aspx" name="formAuthCookie" timeout="60" path="/"/>
</authentication>
...
|
by: Anonieko Ramos |
last post by:
ASP.NET Forms Authentication Best Practices
Dr. Dobb's Journal February 2004
Protecting user information is critical
By Douglas Reilly
Douglas is the author of Designing Microsoft ASP.NET...
|
by: Pradeep Pise |
last post by:
Hello All,
I have a problem in my project. I have used forms authentication and code is embedded in web.config.
<authentication mode="Forms">
<forms name="AuthCookie" path="/"...
|
by: Rob |
last post by:
I'm not sure if I'm missing something but my forms authentication
doesn't work. I'm trying to access my page and I should be redirected to
login.aspx but it just let's me access the page.
Here's...
|
by: Jeremy |
last post by:
I have a web app that contains forms authentication to protect
subdirectory called "admin" by denying anonymous users. When I request
a protected resource in the admin directory I am presented with...
|
by: Charles Arthur |
last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
|
by: BarryA |
last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
|
by: nemocccc |
last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
|
by: Sonnysonu |
last post by:
This is the data of csv file
1 2 3
1 2 3
1 2 3
1 2 3
2 3
2 3
3
the lengths should be different i have to store the data by column-wise with in the specific length.
suppose the i have to...
|
by: Hystou |
last post by:
There are some requirements for setting up RAID:
1. The motherboard and BIOS support RAID configuration.
2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
|
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers,...
|
by: Hystou |
last post by:
Overview:
Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...
| | |