ASP.NET Forms authentication cookies - changing users

Question

I am creating forms authentication cookies using the following code:

string formsCookieStr = string.Empty;
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
            1,                              // version
            username,                       // user name
            DateTime.Now,                   // issue time
            DateTime.Now.AddMinutes(30),    // expires
            false,                          // Persistence
            userRoleData                    // user data
    );
formsCookieStr = FormsAuthentication.Encrypt(ticket);
HttpCookie FormsCookie = new HttpCookie(FormsAuthentication.FormsCookieName, formsCookieStr);
HttpContext.Response.Cookies.Add(FormsCookie);

If a second user tries to login from the same client machine before the first user has logged out, will the code above result in two cookies existing on the client? If so, how do I prevent this state of affairs? Thanks

Mrchief · Accepted Answer · 2014-10-08 15:35:01Z

2

FormsAuthentication.FormsCookieName sets the cookie name, therefore there is only ever one authentication cookie as long as you name it with FormsAuthentication.FormsCookieName

edited Oct 8, 2014 at 15:35

Mrchief

76.4k20 gold badges145 silver badges193 bronze badges

answered Jun 9, 2011 at 12:16

Journeyman

10.3k16 gold badges84 silver badges131 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Chris Marisic Over a year ago

Correct, doing Cookies.Add(name) will create or overwrite any cookie with that name (and same domain).

Akhil · Accepted Answer · 2011-06-07 16:35:50Z

-1

Its Generally a Good Practice to Clear Response Cookies in your Login Page Load or while new Cookie is about to be created: Response.Cookies.Clear(); , so existing User's Ticket is cleared before adding a new ticket.

Having Said that, Your Response will have 2 cookies (for 2 users) in your Response, as you are manually creating a Cookie and adding it to the response.

answered Jun 7, 2011 at 16:35

Akhil

7,6201 gold badge26 silver badges23 bronze badges

2 Comments

Journeyman Over a year ago

but won't the FormsAuthentication.FormsCookieName be unique, and therefore the second cookie will overwrite the first on the client?

Chris Marisic Over a year ago

-1 No there will only be one cookie. Also I'm about 95% certain doing Response.Cookies.Clear() will do nothing but remove any cookies you added to the Cookies collection during this current request. If you want to delete cookies from a user you must ADD cookie to the response with the same name as the cookie you want to delete and send it down as a permanent cookie (has an expiration date) that is set in the past.

Collectives™ on Stack Overflow

ASP.NET Forms authentication cookies - changing users

2 Answers 2

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related