// Create the authentication ticket
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
1, //version
txtUserName.Text, // user name
DateTime.Now, // creation
DateTime.Now.AddMinutes(60),//Expiration
false, //Persistent
String.Join( "|", roles)); // User data
// Now encrypt the ticket.
string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
// Create a cookie and add the encrypted ticket to the cookie as data.
HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName,
encryptedTicket);
// Add the cookie to the outgoing cookies collection.
Response.Cookies.Add(authCookie);
// Redirect the user to the originally requested page
Response.Redirect(FormsAuthentication.GetRedirectUrl(txtUserName.Text, false));
Compare with the proposed approach:
// Get the cookie created by the FormsAuthentication API // Notice that this cookie will have all the attributes according to // the ones in the config file setting. HttpCookie cookie = FormsAuthentication.GetAuthCookie( UserId.Text, false ); FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);
// Store roles inside the Forms Ticket with all the attributes aligned with // the config Forms section. FormsAuthenticationTicket newticket = new FormsAuthenticationTicket( ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, String.Join( "|", roles), ticket.CookiePath); // add the encrypted ticket to the cookie as data. cookie.Value = FormsAuthentication.Encrypt(newticket); // Update the outgoing cookies collection. Context.Response.Cookies.Set(cookie);
// Redirect the user to the originally requested page Response.Redirect( FormsAuthentication.GetRedirectUrl( newticket.Name, newticket.IsPersistent ) );
|
<configuration> <system.web>
<authentication mode="Forms"> <forms loginUrl="Secure/login.aspx" protection="All" requireSSL="true" timeout="10" name="FormsAuthCookie" path="/FormsAuth" slidingExpiration="true" /> </authentication>
</system.web> </configuration> |