CodeVerge.Net Beta


   Explore    Item Entry    Members      Register  Login  
NEWSGROUP
.NET
Algorithms-Data Structures
Asp.Net
C Plus Plus
CSharp
Database
HTML
Javascript
Linq
Other
Regular Expressions
VB.Net
XML

Free Download:




Zone: > NEWSGROUP > Asp.Net Forum > general_asp.net.security Tags:
Item Type: NewsGroup Date Entered: 9/19/2006 10:14:49 AM Date Modified: Subscribers: 0 Subscribe Alert
Rate It:
(NR, 0)
XPoints: N/A Replies: 13 Views: 18 Favorited: 0 Favorite
Can Reply:  No Members Can Edit: No Online: Yes
14 Items, 1 Pages 1 |< << Go >> >|
Ganesh@Nilgris
Asp.Net User
FormsAuthenticationTicket9/19/2006 10:14:49 AM

0/0

I did a little analysis on formsauthenticaion and found that formsauthenticationticket is used to add custom data to the cookies

I have tried the below code to understand the workings of formsauthenticationticket

http://msdn2.microsoft.com/en-us/library/system.web.security.formsauthenticationticket.aspx - this seems to be not working.

i spent 2 hrs in learning but in vain. can any one

 

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>
<script runat="server">

  private void Login_Click(Object sender, EventArgs e)
  {
    // Create a custom FormsAuthenticationTicket containing
    // application specific data for the user.

    string username     = UserNameTextBox.Text;
    string password     = UserPassTextBox.Text;
    bool   isPersistent = PersistCheckBox.Checked;

    if (Membership.ValidateUser(username, password))
    {
      string userData = "ApplicationSpecific data for this user.";

      FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
        username,
        DateTime.Now,
        DateTime.Now.AddMinutes(30),
        isPersistent,
        userData,
        FormsAuthentication.FormsCookiePath); - what we are trying todo here?

 

      // Encrypt the ticket.
      string encTicket = FormsAuthentication.Encrypt(ticket); - what we are trying todo here?

      // Create the cookie.
      Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));

      // Redirect back to original URL.
      Response.Redirect(FormsAuthentication.GetRedirectUrl(username, isPersistent)); - what we are trying todo here?
    }
    else
    {
      Msg.Text = "Login failed. Please check your user name and password and try again.";
    }
  }

</script>
<html>
<head>
    <title>Forms Authentication Login</title>
</head>
<body>
    <form runat="server">
        <span style='BACKGROUND: #80ff80'>
          <h3>Login Page</h3>
        </span>
        <asp:Label id="Msg" ForeColor="maroon" runat="server" /><P>
        <table border=0>
            <tbody>
                <tr>
                    <td>Username:</td>
                    <td><asp:TextBox id="UserNameTextBox" type="text" runat="server" /></td>
                    <td>
                      <asp:RequiredFieldValidator id="RequiredFieldValidator1"
                                                  runat="server" ErrorMessage="*"
                                                  Display="Static"
                                                  ControlToValidate="UserNameTextBox" />
                    </td>
                </tr>
                <tr>
                    <td>Password:</td>
                    <td><asp:TextBox id="UserPassTextBox" TextMode="Password" runat="server" /></td>
                    <td>
                      <asp:RequiredFieldValidator id="RequiredFieldValidator2"
                                                  runat="server" ErrorMessage="*"
                                                  Display="Static"
                                                  ControlToValidate="UserPassTextBox" />
                    </td>
                </tr>
                <tr>
                    <td>Check here if this is <u>not</u><br>a public computer:</td>
                    <td><asp:CheckBox id="PersistCheckBox" runat="server" autopostback="true" /></td>
                </tr>
            </tbody>
        </table>
        <input type="submit" value="Login" runat="server" onserverclick="Login_Click" />
    </form>
</body>
</html>


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
Ganesh@Nilgris
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 5:41:20 AM

0/0

can any one look in the code and give me some help in the analysis of formsauthentication using custom data

its pretty urgent . please help

 


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
etones
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 9:22:30 AM

0/0

Hey,

there are a few things you need to be aware of.

1) The "Membership" class details with users and authentication.

2) The "FormsAuthentication" class deals with remembering an authenticated used between different pages. It does with by writing a value into the users cookie, this value is a secure ticket. To allow it to be secure, it is encrypted (going back to the line you high lighted).

3) The "FormsAuthenticationTicket" class produces the ticket used by the previous class to store in the cookie. You do not really need to play with this class yourself, as the FormsAuthentication class handles it all for you (if you want it to .. example below)

Below is some useful advice i posted to the ASP.NET usenet board.

The FormAuthentication class is the one that creates the encrypted ticket in
the cookie. Thus the following checks to see if a user is valid, if so it
"logs" them in by providing the secure cookie

1    if(Membership.ValidateUser("test", "test123"))
2    {
3        Forms.SetAuthCookie("test");
4    }
5    
 
Finally, a user can be checked to be logged in on any page by
"User.Identity.IsAuthentication".

The following classes will be of use to anyone making there own
authentication systems on the back of the security model provided by ASP.NET
2.0

Membership
FormsAuthentication
FormsAuthenticationTicket
etones
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 9:24:13 AM

0/0

 Sorry, there is an error in my code, it should read:  
1    if(Membership.ValidateUser("username", "somePassword"))
2    {
3        FormsAuthentication.SetAuthCookie("username");
4    }
5    

Taz

Ganesh@Nilgris
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 10:04:06 AM

0/0

 The "FormsAuthentication" class deals with remembering an authenticated used between different pages. It does with by writing a value into the users cookie, this value is a secure ticket. To allow it to be secure, it is encrypted (going back to the line you high lighted).

which means that

the value of a secure ticket in a users cookies is readable,  when it is not encrypted. ok

then how we can read the value of  secure ticket in a users cookies

 


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
etones
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 10:20:51 AM

0/0

Hi,

firstly you need to ask why you want to read the secure ticket. I do not believe that it contains anything useful. Lookup the FormsAuthentication class on msdn2 to figure out how, I have not done it before but there are class members provided.

 Taz

Ganesh@Nilgris
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 10:40:06 AM

0/0

 

It has some significiant , because what is the purpose of encrypt and decrypt() in formasuthentication.

 


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
vivek_iit
Asp.Net User
Re: FormsAuthenticationTicket9/21/2006 8:30:23 PM

0/0

Ganesh,

This post might help:

http://geekswithblogs.net/vivek/archive/2006/09/14/91191.aspx

Regards,

Vivek


MVP, ASP.NET || My Website || Blog || Articles

Please mark the most helpful reply/replies as "Answer".
Ganesh@Nilgris
Asp.Net User
Re: FormsAuthenticationTicket9/22/2006 4:27:38 AM

0/0

Now, I got the answers for all my questions in my mind, It was superb help from you.

well one more clarification. I am not still conviced about the solution for these doubts

<authentication mode="Forms">
<forms name=".ASPXAUTH" loginUrl="/private/login.aspx" protection ="All" timeout="20" path="/" slidingExpiration="true" timeout = "1">
forms
>

1. timeout -> it is not working

2. path - > I dont understand for what it is and what it does

 


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
vivek_iit
Asp.Net User
Re: FormsAuthenticationTicket9/22/2006 7:09:03 AM

0/0

Ganesh,

Why are you suing two timeout values in the config snippedt you pasted?

<forms name=".ASPXAUTH" loginUrl="/private/login.aspx" protection ="All" timeout="20" path="/" slidingExpiration="true" timeout = "1">

I have given a short explanation on the "path" property in my blog, anyways here is it again:

Path tag is used to specify the path where the cookies issued by the web application would be stored. "/" is the recommened setting (also the default).

Hope this helps,

Vivek


MVP, ASP.NET || My Website || Blog || Articles

Please mark the most helpful reply/replies as "Answer".
Ganesh@Nilgris
Asp.Net User
Re: FormsAuthenticationTicket9/22/2006 7:17:36 AM

0/0

i am sorry, it is only one timeout = "1"

after 1 minute the page is not redirected to the login page

i dont really understands by giving path = "/" - what is happening ?

 


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
vivek_iit
Asp.Net User
Re: FormsAuthenticationTicket9/22/2006 10:40:10 AM

0/0

Path sets the FormsCookiePath property of the FormsAuthentication class. This specifies the virtual path which will get transmitted within the cookie (you can see this value when you open the cookie).

-Vivek


MVP, ASP.NET || My Website || Blog || Articles

Please mark the most helpful reply/replies as "Answer".
Ganesh@Nilgris
Asp.Net User
Re: FormsAuthenticationTicket9/22/2006 10:51:00 AM

0/0

 

i didn't get it

 


Jai Ganesh. J , GSD ,India

Please Mark As Answer If my reply helped you.
vivek_iit
Asp.Net User
Re: FormsAuthenticationTicket9/22/2006 12:52:49 PM

0/0

Ganesh,

See this extract from MSDN regarding Path property:

The virtual path to transmit with the cookie. The default is the path of the current request.

The Path property extends the Domain property to completely describe the specific URL to which the cookie applies. For example, in the URL http:/www.microsoft.com/asp, the domain is www.microsoft.com and the path is /asp.

MyCookie.Path = "/asp";

Now, if we change the path to some other value then "/", then the Reponse.Redirect will not work (when you call RedirectFromLoginPage) as the cookie will only be relevant to that URL. You can try yourself and experiment.

-Vivek


MVP, ASP.NET || My Website || Blog || Articles

Please mark the most helpful reply/replies as "Answer".
14 Items, 1 Pages 1 |< << Go >> >|


Free Download:

Books:
Visual Basic .NET Developer's Guide to ASP.NET, XML, and ADO.NET Authors: Jeffrey P. McManus, Chris Kinsman, Pages: 592, Published: 2002
Pro ASP.NET for SQL Server: High Performance Data Access for Web Developers Authors: Brennan Stehling, Pages: 408, Published: 2007
Developing Killer Web Apps with Dreamweaver MX and C# Authors: Chuck White, Pages: 409, Published: 2004
.NET Security and Cryptography Authors: Peter Thorsteinson, G. Gnana Arun Ganesh, Arun Ganesh, Pages: 466, Published: 2003
Professional ASP.NET 2.0 Security, Membership, and Role Management Authors: Stefan Schackow, Pages: 611, Published: 2006
Build Your Own ASP.NET Website Using C# & VB.NET Authors: Zak Ruvalcaba, Pages: 746, Published: 2004
ASP.NET in a Nutshell: In a Nutshell Authors: G. Andrew Duthie, Matthew MacDonald, Pages: 979, Published: 2003
ASP. NET 1.0 Namespace Reference with C# Authors: Jason Bell, Pages: 960, Published: 2002

Web:
FormsAuthenticationTicket Class (System.Web.Security) Minimal)> _ Public NotInheritable Class FormsAuthenticationTicket ... The FormsAuthenticationTicket class is used to create an object that represents the ...
FormsAuthenticationTicket Constructor Initializes a new instance of the FormsAuthenticationTicket class with cookie name, version, expiration date, issue date, persistence, and user-defined data ...
load of tosh : FormsAuthenticationTicket and Persistence I have been playing around with putting forms based authentication on a site I am building. I would like to store a piece of information in the ...
FormsAuthenticationTicket Class The FormsAuthenticationTicket class is used to create an object that represents the authentication ticket that is used by forms authentication to identify ...
FormsAuthenticationTicket, IsPersistent and HttpCookie.Expires ... Ran into a problem that even though I set the IsPersistent parameter of the FormsAuthenticationTicket to true, next time I open the app I have to log in ...
When to use FormsAuthenticationTicket() Talk about When to use FormsAuthenticationTicket()
Cookie and FormsAuthenticationTicket Question... Talk about Cookie and FormsAuthenticationTicket Question...
FormsAuthenticationTicket.Expiration value changing - ASP.NET Forums I am creating a FormsAuthenticationTicket and specifying the timout to be different than the value in web.config. ...
FormsAuthenticationTicket - MSDN Forums Feb 15, 2008 ... I got some code from a MSDN about FormsAuthenticationTicket, so now I know how to create one, and I undertand what it's doing. ...
FormsAuthenticationTicket looses UserData - .NET ASP FormsAuthenticationTicket looses UserData. Get answers to your questions in our .NET ASP forum.




Search This Site:










check existing version of setup program and install a new one

classifieds starter kit is impossible to implement

smartnavigation does not work!

how to define sqlconnection in difference env?

enterprise library june 2005 release - executedataset returns wrong number of rows in dataset

make code controls persistent after a postback!!!

treeview control bound to sitemapdatasource not firing onselectedindexchange

creating a child portal that is ported to a subdomain

system.net.webexception: the remote server returned an error: (407) proxy authentication required.

ctype() and findcontrol()

forms authentication issue!!help

how do i add ssl to my site?

session_end problem help please

dotnetnuke® project :: gallery module installation failure

password encryption

convert a number from a culture to another

inserting <br> html tag into page builder code

handle database connections with care

render problem

requet asp.net (web matrix version) application system

composite control template and designer

online chat code

how to hide and show login form...

pdc session prs418 demo code

converting a collectionbase to 'system.data.dataview'

problem in creating file on a remote computer in network

_publishedwebsites

programmatically adding to the <head> in a content page

customize calendar

custom roles and authorizations.

 
All Times Are GMT