It's quite easy to write an HttpModule to expand app-relative cookie paths to full virtual paths, and to make sure that the Forms Authentication cookie has the path set to the ApplicationBasePath. You simply need to intercept the PreSendRequestHeaders event and process any cookies in the Response.Cookies collection.

However, the cookie path is case-sensitive, so if you set the path to "/wwstore/admin/" and someone requests "/wwStore/Admin/", the cookie won't be sent.


public sealed class CookiePathModule : IHttpModule
{
private string _applicationPath;

public CookiePathModule()
{
}

public void Dispose()
{
}

public void Init(HttpApplication context)
{
_applicationPath = HttpRuntime.AppDomainAppVirtualPath;
if (null != _applicationPath && 0 == _applicationPath.Length) _applicationPath = null;
context.PreSendRequestHeaders += OnPreSendRequestHeaders;
}

private void OnPreSendRequestHeaders(object sender, EventArgs e)
{
HttpApplication application = (HttpApplication)sender;
HttpContext context = application.Context;
HttpCookieCollection cookies = context.Response.Cookies;
if (null != cookies && 0 != cookies.Count)
{
for (int index = 0; index < cookies.Count; index++)
{
ProcessCookie(cookies[index]);
}
}
}

private void ProcessCookie(HttpCookie cookie)
{
if (null != cookie)
{
string path = cookie.Path;
if (!string.IsNullOrEmpty(path))
{
if (path.StartsWith("~/", StringComparison.Ordinal))
{
cookie.Path = _applicationPath + path.Substring(1);
}
else if ("/" == path && null != _applicationPath)
{
if (FormsAuthentication.FormsCookieName == cookie.Name)
{
cookie.Path = _applicationPath + "/";
}
}
}
}
}
}

Rick,

I'm curious why you're using FormsAuthentication.RedirectFromLoginPage in your authenticate handler. It looks like you're using an asp:Login control and handling the Authenticate event. My app does the same thing, but all it does is set e.Authenticated based on our custom authentication store. If it gets set to true, then the LoggedIn event handler is called and then the Login control itself redirects to the originally requested page. I don't have to explicitly do any redirection.

Am I missing something?

Donnie

@Donnie - Usually I'm not using Login control. I hate the way you end up formatting the Login Control so I usually just create my own form and manually call Authenticate. But in this case the point was to be able to explicitly check whether Authentication worked - if you use the default Login control behavior there's not much you can do to see whether the Auth failed or whether there's something wrong with the messaging as in my case.

@Richard - great idea. Case sensitivity shouldn't be an issue as long as you always handle cookie assignment out of a generic routine <s>. In your case though the cookie would always be formatted a specific way anyway since it goes through the module so that should never be an issue unless someone manually assigns the cookie which IMHO is a bad idea anyway. I tend to do all cookie assignments through a routine that handles this as part of the an application library to ensure the abillity to change names/format etc. FWIW, Richard - I see you posting code occasionally here which is great, but could you use the code formatting please? Makes it much easier to read the code...

Hi,

I was just about to write that path is case sensitive and more wasted hours await you. But I've noticed that Richard is "been there done that" kinda guy:)
Don't understand how you can protect yourself from case sensitivity by dealing with path value in single routine. User can type URL in different casing.

First off, Rick Strahl you da MAN! I cannot tell you how many times you've saved me. You always have the most helpfull information. BIG LOVE to you my friend.

anyway, thought i'd share this as i was fighting getting multiple applications on the same server from being authenticated by each other! What a headache. But i did manage to figure out an good solution. you can set the machinekey validation in your web.config file to "IsolateApps" so you do not have to worry about pathing or uniquely naming your authentication cookies.

<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="SHA1" decryption="Auto" />

Man! you have just saved me hours of work. Thank you for your post. It works.

Hi,

i am using authorization and authentication in our site for Admin Area and generating FormsAuthenticationTicket when user login in Admin.
we are handling it in Global.asax under Application_AuthenticateRequest
this is working fine but when i publish my website to upload onto the server (Page wise dll)
then Global.asax also covert into dll, and not working on server.
I am posting my code also...Please do some help

Login Page:
protected void btnsubmit_Click(object sender, EventArgs e)
{
if (Page.IsValid)
{
ObjAdminLogin.AdminPassword = txtpassword.Text.Trim();
ObjAdminLogin.AdminUserName = txtusername.Text.Trim();
DataTable dt = ObjAdminLogin.FetchData().Tables[0];
if (dt.Rows.Count != 0)
{
DataRow row = dt.Rows[0];
Session["UserName"] = txtusername.Text.Trim();
Session["AdminID"] = ObjAdminLogin.AdminID;
Session["DeptID"] = row["DeptID"].ToString();

if (row["DeptID"].ToString() == "2")
{
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket
(1, txtusername.Text.ToString().Trim(), DateTime.Now,
DateTime.MaxValue, false, "Admin");
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
Response.Cookies.Add(authCookie);

}
else if (row["DeptID"].ToString() == "1")
{
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket
(1, txtusername.Text.ToString().Trim(), DateTime.Now,
DateTime.MaxValue, false, "Support");
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
Response.Cookies.Add(authCookie);
}
else if (row["DeptID"].ToString() == "3")
{
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket
(1, txtusername.Text.ToString().Trim(), DateTime.Now,
DateTime.MaxValue, false, "Marketing");
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
Response.Cookies.Add(authCookie);
}
else if (row["DeptID"].ToString() == "4")
{
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket
(1, txtusername.Text.ToString().Trim(), DateTime.Now,
DateTime.MaxValue, false, "Merchandise");
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
Response.Cookies.Add(authCookie);
}
else if (row["DeptID"].ToString() == "5")
{
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket
(1, txtusername.Text.ToString().Trim(), DateTime.Now,
DateTime.MaxValue, false, "Logistics");
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
Response.Cookies.Add(authCookie);
}

if (Request.QueryString["ReturnUrl"] == null)
{
Response.Redirect("~/Welcome.aspx");
}
else
{
Response.Redirect(Request.QueryString["ReturnUrl"]);
}
}
else
{
lblmsg.Text = ObjAdminLogin.Message;
lblmsg.Visible = true;
}
}
}
web.config:
<authentication mode="Forms">
<forms loginUrl="~/Welcome.aspx" name=".ASPNETAUTH" slidingExpiration="true" timeout="90" protection="All" path="~/"></forms>
</authentication>
<location path="create-sale">
<system.web>
<authorization>
<allow roles="Admin,Merchandise"/>
<deny roles="Support,Marketing,Logistics"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
<location path="user-management">
<system.web>
<authorization>
<allow roles="Marketing"/>
<deny roles="Support,Logistics,Merchandise"/>
<allow roles="Admin"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
Global.aspx:
protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
{
HttpCookie authcookie = Request.Cookies[FormsAuthentication.FormsCookieName];
FormsAuthenticationTicket authticket = null;
authticket = FormsAuthentication.Decrypt(authcookie.Value);
string[] roles;
ArrayList arrroles = new ArrayList();
foreach (string userdata in authticket.UserData.Split(';'))
{
arrroles.Add(userdata);
}
roles = (string[])arrroles.ToArray(typeof(string));
FormsIdentity id = new FormsIdentity(authticket);
System.Security.Principal.GenericPrincipal principal = new System.Security.Principal.GenericPrincipal(id, roles);
Context.User = principal;
}
}

all the dll are in BIN Folder with Global.asax

Regards
Asif

I have a problem. it seems my auth cookie and session cookies are getting saved to a machine level folder. What is happening is after I login in using an instance of web browser and then open another instance of web browser and navigate to the same url the I get logged in automatically. What could be wrong?

Any help?

Regards

I found out that the above behavior is by web design. So, if someone is looking for a solution for the same above problem, please do not. This is how the websites are designed one session per machine.
we solved the above problem by adding a hidden filed to all webpages and initializing it with a random unique no. we check for this filed in all requests if that is available and the value in it is the one we have in our session object, then the request is coming from the same browser else not.

Regards,