I am using formAuthentication with the following Web.Config file.
<authentication mode="Forms">
<forms name="SnowBall" timeout="30" slidingExpiration="true" loginUrl="Login.aspx" cookieless="AutoDetect">
</forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
I have a user control which has a LogOut button. Code of the logout button is:
FormsAuthentication.SignOut();
Response.Redirect("Login.aspx");
After executing this code, I am no longer able to authenticate the user. When i click "Sign In", the page is refreshed and event handlers are not executed.
When I close the browser window and re-run the site, everything works fine. Please help me.
First you need to clear that there are two separate Ids one is session id which is alloted for browser session and another is form authentication cookie which is encrypted alphanumeric id.
Whenever you use formauthentication.signout your formauthentication cookies will removed as per your implementation.But your session id will remain there.
You cancheck it by using fiddler/ firefox browser.
I have found the solution.Hope it helps somebody out there
Problem lies with this line
Response.Redirect("Login.aspx");
What it does is redirects user to Login.aspx with ReturnUrl as querystring.For Eg.
Login.aspx?ReturnUrl="Name of the page from where logout happened";
Now what happened was that FormsAuthentication.GetRedirectUrl() preserved this querystring path and after authentication was redirecting to this path.the user credentials i was putting in were not authorized to view this page.So i was always on the login screen.
To Resolve this issue replace
Response.Redirect("Login.aspx");
With
Response.Redirect(FormsAuthentication.LoginUrl);
Related
The default document feature is turned off in IIS and here's the situation...
My start page for my project say is A.aspx. I run the project and sure enough, A.aspx appears in the url of the browser. Like it should though, A.aspx finds no user logged in and redirects to Login.aspx like it should.
A.aspx:
if (Session["UserStuff"] == null)
Response.Redirect("~/Account/Login.aspx");
The login.aspx shows up BUT when the user Logs in, the code:
FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, true);
always redirects to "Default.aspx" and not "A.aspx"
I've examined FormsAuthentication.GetRedirectUrl and sure enough it returns "Default.aspx"
I'm stumped????
In web.config you could set the default page using the defaultUrl attribute:
<authentication mode="Forms">
<forms
loginUrl="login.aspx"
defaultUrl="a.aspx"
protection="All"
timeout="30"
/>
</authentication>
http://www.codeproject.com/KB/aspnet/custom_authentication.aspx Follow this
If you're using FormsAuthentication, your settings should be defined in the web.config. It sounds like you have a default setting in the web.config for DefaultUrl. You shouldn't need the session redirect though. FormsAuthentication should perform this for you. It doesn't hurt to check the session and force a SignOut() if you don't find it, but FormsAuthentication should perform this redirect.
From my understanding, when the user is redirectoed to your login screen, the Forms Authentication mechanism will add the url of the page that the user was originally tring to access, to the login url that that they user tried to access. For example, if you had a login page: http;//bob/login.aspx, and a user tried to access http;//bob/showmethemoney.aspx, then they would get redirected to http;//bob/login.aspx?ReturnUrl=showmethemoney.aspx. So, if you use the ReturnUrl to redirect the user after the user logs in, the user will always be returned to the resource that they were originally trying to get to.
In asp.net we specify the redirect url when using forms authentications like this:
<authentication mode="Forms">
<forms name="myApp" loginUrl="Login.aspx" protection="All" defaultUrl="default.aspx" path="/" requireSSL="false"/>
</authentication>
this means that when a user log in, will be redirected to "default.aspx"
using this method
FormsAuthentication.RedirectFromLoginPage(IDTextBox.Text, RememberCheckBox.Checked);
Now is it possible to make the user choose which page to be redirected to prior to login ?
for example the user chooses from a list the page to login to prior to login then when authenticated be redirected to this page instead of the default.aspx page.
is that possible and if so how can this be done ?
Instead of using the RedirectFromLoginPage method you could use the SetAuthCookie method and then redirect manually:
FormsAuthentication.SetAuthCookie(IDTextBox.Text, RememberCheckBox.Checked);
Response.Redirect("some url the user has choosen");
I use FormsAuthentication.RedirectFromLoginPage(userName.Trim(), false); to set the User.Identity.Name field that I reference later. When I execute this line, the User.Identity object does not update at all; it contains whatever it was previously set to. All the documentation I see online says this should update my User.Identity object with the correct name, but I don't see that happening.
I have the web config set up properly with the following lines:
<authentication mode="Forms">
<forms name="formsauth" loginUrl="Login.aspx" protection="All" timeout="60">
</forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
I am relatively new to this stuff, so any help is appreciated. Thanks!
It will be updated on the next request but not on the next line following it. RedirectFromLoginPage sets an authentication cookie in the client browser that will be read upon the next client request and you will see the User.Identity.Name property updated. Updating this property in the same HTTP request is meaningless as you already know that the user passed authentication as you called the method.
i have a login page so once the user enters the correct details he enters into the home page. Now i want to implement 3 things
once he clicks the button 'log out' he must be redirected to a page saying" logged out successfully " n even if clicks the back button in the browser, he should not be able to access.
if the user leaves the homepage idle for a specific amount of time say 10minutes and then he tries to navigate after 10 mins a msg should display saying "Your Session has been expired login again"
if given the url of homepage he shouldnt be able to access unless logged in.
I am not sure about what exactly i need to do and how to do. Plz Help
Regards
Indranil Mutsuddy
1) When the user logs out of the system I would recommend doing a Session.Abandon(). If the user clicks the Back button in the browser he might see the cached version of the old page (this is entirely browser dependant), but he won't be able to do anything anyway.
Disable the caching in your pages and the user shouldn't even see the cached old version :)
A simple way to do this would be to add the following into Global.asax's Application_BeginRequest:
HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.NoCache);
HttpContext.Current.Response.Cache.SetNoStore();
2) In your web.config set the session lifetim to 10 minutes, incremental.. That will do the trick
<system.web>
<authentication mode="Forms">
<forms defaultUrl="~/LoggedIn.aspx" loginUrl="~/Login.aspx" protection="All" path="/" slidingExpiration="true" timeout="10"/>
</authentication>
</system.web>
3) You can do this using authorization rules in web.config. If you want no anonymous users to access your website just enable access only to logged in users like this:
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
If you want to restrict access not to the whole website, but only to some areas (like the MyAccount area, then you can add this instead.. Note: Web.config can have multiple <location> elements!
<location path="MyAccountFolder">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
There's one important note about the location tag. The Path does NOW start with a '/'! So if you want to secure the /MyAccount folder, then your tag will start like this:
<location path="MyAccount" />
You should generally use ASP.NET Forms Authentication for this.
When the Log Out button is clicked, call FormsAuthentication.SignOut. This will remove the forms-authentication ticket information from the cookie (or URL if cookieless).
For a timeout, use the timeout attribute in the system.web/authentication/forms element of your web.config. Note that your forms authentication timeout is independent of your Session timeout.
Case 1:
When clicked on the log off button clear the Session.
Clicking the back button in the browser might result in fetching the page from the cache. So by cheking Session in the page might not be effective. You can disable caching for the page so that when back button is clicked a new request to the page will be generated.
For pages not to be cached set this
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Case 2:
You can set the default timeout for Session as 10 minutes. See HttpSessionState.Timeout Property
Case 3:
Check Session for null and if found to be null then redirect to a login page.
I have one application where after successful Login user will be redirected to Home.aspx.
Now if I try Response.Redirect("Home.aspx") it doesnt work, But if I try
FormsAuthentication.RedirectFromLoginPage(TextBox1.Text, false);..its working.
Now my question is why Response.Redirect() is not working?
I know FormsAuthentication.RedirectFromLoginPage do much more than Login, it also sets cookie,and also redirects to Login Page, but why Redirct() is not working?
web.config:
<authentication mode="Forms">
<forms loginUrl="LogIn.aspx" defaultUrl="Home.aspx" path="/"></forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
Can somebody help?
You already have the answer pretty much.
Response.Redirect does not set the authentication cookie so when Home.aspx is loading it fails authentication and will redirect you back to the login page.
To use response.redirect, you will have to manage the cookie yourself, an example from https://web.archive.org/web/20210513002246/https://www.4guysfromrolla.com/webtech/110701-1.3.shtml is:
Dim cookie As HttpCookie = FormsAuthentication.GetAuthCookie(UserName.Text, _
chkPersistCookie.Checked)
Response.Cookies.Add (cookie)
Response.Redirect(FormsAuthentication.GetRedirectUrl (UserName.Text, _
chkPersistCookie.Checked))
EDIT:
To answer the question in your comment, if you pass true as the second parameter to RedirectFromLoginPage then the cookie will be set to never expire, and you won't need to login again.
FormsAuthentication.RedirectFromLoginPage(TextBox1.Text, true)