Member Avatar for nccsbim071

It's long but simple. I have only explained the problem in detail.

After searching a lot i did not get any answers and finally i had to get back to you. Below i am explaining my problem in detail. It's too long, so please don't quit reading. I have explained my problem in simple language.

I have been developing an asp.net mvc project. I am using standard ASP.NET roles and membership. Everything is working fine but the remember me functionality doesn't work at all. I am listing all the details of work. Hope you guys can help me out solve this problem.

I simply need this:

I need user to login to web application. During login they can either login with remember me or without it. If user logs in with remember me, i want browser to remember them for long time, let's say atleast one year or considerably long time. The way they do it in www.dotnetspider.com,www.codeproject.com,www.daniweb.com and many other sites. If user logs in without remember me, then browser should allow access to website for some 20 -30 minutes and after that their session should expire. Their session should also expire when user logs in and shuts down the browser without logging out.

Note: I have succesfully implemented above functionality without using standard asp.net roles and membership by creating my own talbes for user and authenticating against my database table, setting cookie and sessions in my other projects. But for this project we starting from the beginning used standard asp.net roles and membership. We thought it will work and after everything was build at the time of testing it just didn't work. and now we cannot replace the existing functionality with standard asp.net roles and membership with my own custom user tables and all the stuff, you understand what i am taling about.

Either there is some kind of bug with standard asp.net roles and membership functionality or i have the whole concept of standard asp.net roles and membership wrong. i have stated what i want above. I think it's very simple and reasonable.

What i did

1. Login form with username,password and remember me field.
2. My setting in web.config:

<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880"/>
</authentication>

3. in My controller action, i have this:

FormsAuth.SignIn(userName, rememberMe);
      public void SignIn(string userName, bool createPersistentCookie) { FormsAuthentication.SetAuthCookie(userName, createPersistentCookie); }

Now the problems are following:

I have already stated in above section "I simply need this". user can successfully log in to the system. Their session exists for as much minutes as specified in timeout value in web.config. I have also given a sample of my web.config. In my samplem if i set the timeout to 5 minutes,then user session expires after 5 minutes, that's ok. But if user closes the browser and reopen the browser, user can still enter the website without loggin in untill time specified in "timeout" has not passed out. The sliding expiration for timeout value is also working fine. Now if user logs in to the system with remember me checked, user session still expires after 5 minutes. This is not good behaviour, is it?. I mean to say that if user logs in to the system with remember me checked he should be remembered for a long time untill he doesn't logs out of the system or user doesn't manually deletes all the cookies from the browser. If user logs in to the system without remember me checked his session should expire after the timeout period values specified in web.config and also if users closes the browser. The problem is that if user closes the browser and reopens it he can still enter the website without logging in.

I search internet a lot on this topic, but i could not get the solution. In the blog post() made by Scott Gu on exactly the same topic. The users are complaining about the same thing in their comments ut there is no easy solution given in by Mr. Scott.

I read it at following places:

I guess this is a problem of lot's of users. As seem from blog post made by Mr. Scott Gu.

Your help will be really appreciated. Thanks in advance.

Edited by nccsbim071 because: n/a
  • 2 Contributors
  • 3 Replies
  • 1K Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by kvprajapati

Dani AI

Generated

Quick expert summary (short answer up front): the behavior you described is normal for ASP.NET forms authentication — the checkbox passed to SetAuthCookie controls whether the browser gets a session cookie (deleted on a normal browser exit) or a persistent cookie (an Expires header). The actual time the server accepts the ticket is controlled by the <forms timeout> (and slidingExpiration) in web.config, so simply checking "remember me" does not by itself change the ticket-expiration logic unless you change the ticket or timeout. This explains s observations; correctly pointed to a Microsoft KB that helped in the specific environment. (learn.microsoft.com)

Key details and why you saw unexpected results: a non-persistent cookie has no Expires attribute and is normally removed at browser exit, but many modern browsers can “restore session” and therefore preserve session cookies across restarts (so closing the browser does not always log a user out). Also, ASP.NET issues the ticket expiry based on the <forms timeout> (and can reissue it when slidingExpiration is enabled), so persistent cookies still respect that ticket lifetime in ASP.NET 2.0+. That combination is the usual root cause. (textslashplain.com)

Practical fixes / troubleshooting steps:

  • Inspect the auth cookie in DevTools: if Expires says "Session" it is non-persistent; otherwise a timestamp shows persistence.
  • If you want a true year-long remember-me, either raise the <forms timeout> (minutes) or issue a custom FormsAuthenticationTicket with a longer Expiration and set cookie.Expires when remember-me is chosen. Example (minimal):
    var ticket = new FormsAuthenticationTicket(1, username, DateTime.UtcNow,
  rememberMe ? DateTime.UtcNow.AddYears(1) : DateTime.UtcNow.AddMinutes(30),
  rememberMe, "");
var enc = FormsAuthentication.Encrypt(ticket);
var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, enc);
if (rememberMe) cookie.Expires = ticket.Expiration;
Response.Cookies.Add(cookie);

    Also align sessionState timeout if you rely on Session, secure the cookie (HttpOnly/RequireSSL), and, for farms, ensure machineKey consistency so tickets decrypt across servers. (learn.microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for kvprajapati

This is a must read. I suggest you to read this article -

Member Avatar for nccsbim071

thanks adatapost, reading the article helped me solved my problem.

I also aked the same question on www.stackoverflow.com and i got the solution there. click here for solution.

commented: Thanks! +8
Member Avatar for kvprajapati

Thanks nccsbim071 for sharing knowledge with us.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.