CodeVerge.Net Beta


   Explore    Item Entry    Members      Register  Login  
NEWSGROUP
.NET
Algorithms-Data Structures
Asp.Net
C Plus Plus
CSharp
Database
HTML
Javascript
Linq
Other
Regular Expressions
VB.Net
XML

Free Download:
Zone: > NEWSGROUP > Asp.Net Forum > general_asp.net.security Tags:
Item Type: NewsGroup Date Entered: 1/5/2007 11:07:25 AM Date Modified: Subscribers: 0 Subscribe Alert
Rate It:
(NR, 0)
XPoints: N/A Replies: 2 Views: 35 Favorited: 0 Favorite
Can Reply:  No Members Can Edit: No Online: Yes
3 Items, 1 Pages 1 |< << Go >> >|
Killer_B
Asp.Net User
Session and form authentication1/5/2007 11:07:25 AM

0/0

I have form authentication in my application which has cookie timeout set to 20 minutes. Cookie is being removed after 20 minutes of user's innactivity. I also have some data stored in session which has timeout set also to 20 minutes.

If I set cookie timeout to less than session everything works fine and user is redirected to login page. But if session expires before cookie, which is most likely, all data gets lost.

I tried to force form authentication logout at session end in global.asax but it doesn't work. I used this code in global.asax:

FormsAuthentication.SignOut()
FormsAuthentication.RedirectToLoginPage()

Am I doing this right or is there any other better way to handle this.

Thanks
 
ask_Scotty
Asp.Net User
Re: Session and form authentication1/7/2007 8:49:23 PM

0/0

Hello my friend,

The code seems right but it is in the wrong place.  Within your page code, check if a session variable exists.  If not, use the 2 lines above to kick the user out.  Something like the following: - 

if

 (Session["SavedDataField"] == null)

{

FormsAuthentication.SignOut();

FormsAuthentication.RedirectToLoginPage();

}

If you need to do this on multiple web pages, create a new class called CustomBasePage like the following: -

 

using System;

using

 System.Data;

using

 System.Configuration;

using

 System.Web;

using

 System.Web.Security;

using

 System.Web.UI;

using

 System.Web.UI.WebControls;

using

 System.Web.UI.WebControls.WebParts;

using

 System.Web.UI.HtmlControls;

///

 <summary>

///

 Summary description for CustomBasePage

///

 </summary>

public

 class CustomBasePage : System.Web.UI.Page

{

public CustomBasePage()

{

this.PreInit += new EventHandler(CustomBasePage_PreInit);

}

void CustomBasePage_PreInit(object sender, EventArgs e)

{

if (Session["SavedDataField"] == null)

{

FormsAuthentication.SignOut();

FormsAuthentication.RedirectToLoginPage();

}

}

}

 

Now for any web page where you need to make this check, change it so that it inherits from this new class instead of System.Web.UI.Page

For example: -

public

 partial class PageName : CustomBasePage

 

Hope this does the trick my friend

Kind regards

Scotty

 

 
Killer_B
Asp.Net User
Re: Session and form authentication1/8/2007 6:22:26 AM

0/0

I kinda knew that this is possible but I thought that this could be done using global.asax. Thanks for your reply.
3 Items, 1 Pages 1 |< << Go >> >|


Free Download:

Books:
Professional ASP.NET 2.0 Security, Membership, and Role Management Authors: Stefan Schackow, Pages: 611, Published: 2006
Sams Teach Yourself JavaServer Pages 2.0 with Apache Tomcat in 24 Hours: Complete Starter Kit, with Apache Tomcat Authors: Mark Wutka, Alan Moffet, Kunal Mittal, Pages: 552, Published: 2003
Special Edition Using Java Server Pages and Servlets: Special Edition Authors: Mark Wutka, Pages: 754, Published: 2000
ASP.NET Kick Start: Kick Start Authors: Stephen Walther, Pages: 624, Published: 2002
Beginning ASP.NET 2.0 in C# 2005: From Novice to Professional Authors: Matthew MacDonald, Pages: 1148, Published: 2006
C# Professional Projects Authors: Geetanjali Arora, Balasubramaniam Aiaswamy, Nitin Pandey, NIIT (Corporation), Pages: 919, Published: 2002
Hacking the Code: ASP.NET Web Application Security Authors: Mark Burnett, James C. Foster, Pages: 447, Published: 2004
Foundations of Security: What Every Programmer Needs to Know Authors: Neil Daswani, Christoph Kern, Anita Kesavan, Pages: 290, Published: 2007
Tony Redmond's Microsoft Exchange Server 2003: With SP1 Authors: Tony Redmond, Pages: 1008, Published: 2004
Mastering SQL Server 2005 Reporting Services Infrastructure Design Authors: Joseph L. Jorden, Pages: 486, Published: 2007

Web:
ASP.NET.4GuysFromRolla.com: Dissecting Forms Authentication Jul 20, 2005 ... Clearly session variables are not at play with forms-based authentication; instead, cookies are used, which might have been obvious enough ...
Session and form authentication - ASP.NET Forums Now here is my understand about above flow. when session and Form Authentication is timeout (it is timing out at the same time in my case. ...
Explained: Forms Authentication in ASP.NET 2.0 Code in the logon page creates a cookie that contains a forms authentication ticket that is set for the session. In ASP.NET 2.0, the validation of user ...
Simple Form Authentication in 1.2.x.x (Articles) | The Bakery ... Simple Form Authentication in 1.2.x.x. Tutorials Apr 17, 2007 ... all aspects of MVC in an authentication role, logging a user in, maintaining a session, ...
.NET HITMAN: Forms Authentication Timeout vs Session Timeout The problem was that if we set the forms authentication and session timeouts to 10 minutes and after the 10th minute the user clicked on any link the app ...
Simple ASP Authentication System This is the default authentication status Session("Authenticated") = 0 ... We get the user information from the login.asp (remember the form elements?) ...
ClickTale Support • View topic - Supporting ASP.NET 2.0 sessions ... NET web site uses sessions (storing data in the Session[] object) or .NET's built-in Forms Authentication then ClickTale may not be able to ...
Forms Authentication Session Staying Open - .Net Development As most of you know, I've setup my app to use forms authentication and have been having a few "issues". I've been playing around with code.
Mailing list archives Apr 4, 2008 ... Subject, Apache support for form authentication ... Who can use the session? Any other Apache or third party modules can use the session ...
IBM Products Forms Authentication Session Hijacking - Secunia ... A security issue has been discovered in multiple IBM products, which under some circumstances potentially can be exploited by malicious people to hijack an ...

Videos:
Google Developer Day London: GData APIs - Part 1 Google's mission is to organize the world's information and make it universally accessible and useful. The Google Data protocol helps accomplish this...
A modular approach to authentication and key exchange, by Ran Canetti Presented at Crypto '98 rump session. A presentation of two papers: 1. A modular approach to authentication and key exchange, by Mihir Bellare, Ran...
ISTTF Meeting - Age Verification Group #2 Company Presentations III Internet Safety Technical Task Force open meeting, September 23, Harvard Law School -Combining Multiple Technologies and Authentication Tools • icou...
How not to authenticate code, by Nicko van Someron Presented at Crypto '98 rump session.
OpenID : In Drupal core and your CMS too James Walker: Bryght Guy and Drupal Developer Presentation at OSCMS 2007 "OpenID is an open, decentralized, free framework for user-centric digital i...
Google I/O 2008 - Authenticating to Google Data Services Authenticating to Google Data Services Jeff Fisher, Jeff Scudder (Google), and Bing Yang (Salesforce.com) Get over that first hurdle in your prototy...
Integrating Bomgar into your Help Desk Infrastructure http://www.bomgar.com/ - Bomgar offers a number of ways to integrate the Bomgar Box into your existing help desk infrastructure. [LDAP for Active Dir...
The Velvet Underground And Nico (A Symphony of Sound)-01 The Velvet Underground And Nico (A Symphony of Sound) is a portrait of the band, recorded during a practice session at the Factory; shot in January 1...
Owasp5034 - Jian Hui Wang - Lotus Notes And Domino Web Application Security Recorded at the Open Web Application Security Project (www.OWASP.org) NYC Conference on Sep 25, 2008 – Content produced by www.MediaArchives.com - Ma...
Integrating Bomgar into your Help Desk Bomgar offers a number of ways to integrate the Bomgar Box into your existing help desk infrastructure. [LDAP for Active Directory & Universal Direct...




Search This Site:










dotnetnuke setup problems

referencing a helper library with debug files

need help with simple web.config file in asp.net 2.0

accessing forum in ddd site gives error

the type initializer for 'tags' threw an exception??

using collections in a class

generic methods to base application address

lots of general exceptions

form controls, cancel button

forming local dnn sigs...

making the case for a core tagging functionality

what is difference between aspnet_user db table and aspnet_membership table?

better position to set theme

how do i make immages linkable?

child portal logging out admin

whidbey: tired with sessions? - use the new profile property to store user information

system messages

ibs caching issues on network?

io error has occured while writing to the exception log

geo-targeting ?

search a table and display results

create a wizard

forms auth, web.config problem

i need help with the classifieds starter kit

no price protection even at check out

adding javascript in content page

basic questions

login

question on namevaluecollection

easy forms best practice question
 
All Times Are GMT