forms authentication cookie replacement

Question

I have a problem with users being kicked out after the forms authentication ticket is renewed and the old one has expired. The first ticket i get when i signed in is:

Ticket: A094D6F0401A5B6D97688198B09F17B03D209............ Ends: Thu, 28 Mar 2013 08:56:33 GMT

And after some time the ticket is renewed and i get this cookie: (The cookie expire when the ticket is expire, so no problem there)

Ticket: 215373E662852AD0CC540AC27F547787............. Ends: Thu, 28 Mar 2013 08:58:17 GMT

This ticket is renewed by a javascript reloader in the background for the user. Now, if i update the page, i will be kicked out, why? When i renew the ticket i use this:

        var Id = (FormsIdentity)HttpContext.Current.User.Identity;
        var Ticket = Id.Ticket;

        var NewAuthTicket = FormsAuthentication.RenewTicketIfOld(Ticket);

        HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(new FormsIdentity(NewAuthTicket), new[] {""});

        if (NewAuthTicket != null && NewAuthTicket.Expiration > Ticket.Expiration)
        {
            // Create the (encrypted) cookie.
            var ObjCookie = new HttpCookie(FormsAuthentication.FormsCookieName,
                                           FormsAuthentication.Encrypt(NewAuthTicket))
                                {
                                    HttpOnly = true,
                                    Expires = NewAuthTicket.Expiration,
                                    Secure = FormsAuthentication.RequireSSL
                                };
            // Add the cookie to the list for outbound response. 
            HttpContext.Current.Response.Cookies.Add(ObjCookie);
            Ticket = NewAuthTicket;
         }

Is there any solution for this?

UPDATE:

When i set the cookie for the first time i use this:

var ExpiryDate = !rememberMe ? DateTime.Now.AddMinutes(cookieTimeoutHour) : DateTime.Now.AddYears(1);

                //create a new forms auth ticket
                var Ticket = new FormsAuthenticationTicket(2, ui.UserNr.ToString(CultureInfo.InvariantCulture), DateTime.Now, ExpiryDate, true, String.Empty);
                //encrypt the ticket
                var EncryptedTicket = FormsAuthentication.Encrypt(Ticket);
                //create a new authentication cookie - and set its expiration date
                var AuthenticationCookie = new HttpCookie(FormsAuthentication.FormsCookieName, EncryptedTicket)
                                               {
                                                   Expires = Ticket.Expiration,
                                                   HttpOnly = true,
                                                   Secure = FormsAuthentication.RequireSSL
                                               };


                Current.Response.Cookies.Add(AuthenticationCookie);

Nathan · Accepted Answer · 2013-03-28 09:26:48Z

0

Why go to all that effort when a simple keep-alive on the client page will keep the forms authentication cookie alive?

jQuery example:

$(function() {
    window.setInterval(keepalive, 600000); // run keepalive every 10 mins
});

function keepalive()
{
   $.get({url:'/myemptykeepalivepage.aspx',cache:false});
}

When the client closes the browser, the interval function is cancelled and voila, the forms auth ticket will expire naturally.

answered Mar 28, 2013 at 9:26

Nathan

6,2244 gold badges38 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

mrcode Over a year ago

I have try that. I have used slidingExpiration="true" in the web.config, and not using the code above, but then the ticket is renewed, but not the expiring time of the cookie. And when the cookie is expired, the user is kicked out. When i use my code, the ticket timeout and the cookie timout is extended, but the user is still kicked out. Why?

Nathan Over a year ago

Use the code above (put it in a script file which is referenced from the head tag of every page in your site). That code, combined with slidingExpiration="true" will solve your problem (of course, you have to check that the code above runs more frequently than the timeout of your forms ticket)

Nathan Over a year ago

(all the code above does is makes sure that the user hits the web server at least every 10 mins, thereby forcing the forms ticket to be kept 'alive')

mrcode Over a year ago

ok, i will try that again. But there is no wrong when i create the first cookie? (i updated my question)

mrcode Over a year ago

Thanks, i will try a simpler way =)

|

Collectives™ on Stack Overflow

forms authentication cookie replacement

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related