We don't as yet use the login control, but we were thinking of doing so. If
it is true that checking the Login Control Remember Me causes the browser,
effectively, to cache the Session, then I'd regard it - at first glance,
anyway - as a huge security hole: and we would definitely not consider using
this control, on that basis.
Sigh. The session isn't preserved.
First of all, all the session state data is stored on the server, not
the client, and since a session statebag can hold all sorts of objects
of unlimited size, it would be a colossal waste of resources on the
server. Secondly, if you were implying that the session would be
cached at the client, that's even more preposterous--HTML apps can
only write data on the client machine in the form of cookies (unless
some 3rd party control is involved) and a cookie is limited to 4KB, so
there simply isn't enough room to cache sesson data at the client--and
if that were the case, everything that you threw into the session
state would have to be serializable.
There are two different cookies going on here: there is the
FormsAuthentication Cookie, without which the .NET security wouldn't
work, and the Session Cookie, which simply holds the session ID.
The FormsAuthentication cookie needs to be present, and is checked by
the framework before authorizing access any secured resources. (By the
way, you can modify and enhance this behavior by adding a payload to
the UserData property of the FormsAuthenticationTicket, and tweaking
the application's Application_AuthenticateRequest subroutine in your
application's global.asax.) The data in the FormsAuth cookie is
encrypted, and the innerworkings of it are a bit beyond the scope of
this conversation, but let's just say that it magically preserves your
username and the fact that you were once authenticated successfully.
The session cookie simply contains a variable that is used to match up
the users session statebag (which always remains on the server) with
the current HTTP request.
The session cookie is temporary--it never even gets written to the
filesystem on the client--and it will be removed when the browser is
closed.
The FormsAuthentication cookie often DOES get written to the file
system--or at least, it can, based on your web.config settings.
Typically, I set the FormAuth expiration so it behaves like a session
cookie, because that is the behavior most people are used to.
What the "Remember Me" feature of the login control does is, on a
successful login, sets the FormsAuthentication cookie to not expire
for 50 days. That's all, nothing more.
So when you re-open the browser, Luqman, you are logging in, but you
are technically starting a new session. You can confirm this by
writing the session id out to the response; you should see a different
id every time you close all of your windows and open it.
Response.Write(Session.SessionID)
This can be a great feature, as long as your users (and your code)
expect it.
Happy Coding,
-Mark
??