FormsAuthentication

[Grant Merwitz]

Hi, i am using forms authentication in an ASP.NET project

I am setting the Forms authentication cookie by using:
FormsAuthentication.RedirectFromLoginPage(UserName.Text, false);

Now when i review my trace on my page, there are two cookies created that
look identical.
When i FormsAuthentication.SignOut() they both dissappear.

Any ideas as to why two cookies are created?

TIA

P.S. Sorry for the double post, i thought this was more relevant in the
..security newsgroup

 

[jjardine]

Hi, i am using forms authentication in an ASP.NET project

I am setting the Forms authentication cookie by using:
FormsAuthentication.RedirectFromLoginPage(UserName.Text, false);

Now when i review my trace on my page, there are two cookies created that
look identical.
When i FormsAuthentication.SignOut() they both dissappear.

Any ideas as to why two cookies are created?

TIA

P.S. Sorry for the double post, i thought this was more relevant in the
.security newsgroup

I am not sure why they do this. It might be for tighter security and to
help stop cookie poisoning or some other form of attach on the cookies.

 

[Hernan de Lahitte]

It should be only one cookie (non persistent) per Forms session.
Check out if you perhaps did some testing with persist=true parameter of
RedirectFromLoginPage function and the you might have an old persistent
cookie from that testing session.

 

[Grant Merwitz]

can't be.

When i log out, using FormsAuthentication.SignOut();

both cookies disappear from the cookies collection.
Then when i sign in again, both reappear.

This application is set up as a virtual directory. Could that have something
to do with it?

 

[Hernan de Lahitte]

Do you have any code sample of your login page and any other section that
you may dealing with Forms Authentication or your Principal object ? (cookie
handling as well )

 

[Grant Merwitz]

excuse the late response

i actually realised it was only when my application was running as a virtual
directory.
When i changed it to be the root directory, the second cookie suddenly
disappeared.

strange