Groups | Blog | Home
all groups > asp.net security > july 2005 >

asp.net security : forms authentication cookie changes



Andy Fish
7/21/2005 12:00:00 AM
Hi all,

For reasons I would rather not go into, I sometimes need to get the value of
the forms authentication cookie and use it later when submitting another
request to the server.

mostly this works fine but sometimes it seems that the server decides to
change the forms authentication cookie (in contrast to the session cookie
which stays the same the whole time the session is in existence).

note that this is not happening because the authentication timeout has
expired. I am still logged on as the same user and have the same session;
it's just that the cookie value has changed.

Can anyone explain why and how this happens, and if there is any way I can
control (or disable) this behaviour?

TIA

Andy



Dominick Baier [DevelopMentor]
7/21/2005 10:07:16 AM
Hello Andy,

FormsAuth issues a new cookie after timeout/2. That's the behaviour when
you have sliding expiration enabled.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]


Andy Fish
7/22/2005 9:08:11 AM
Thanks Dominick.

I knew it re-sent the cookie after half the timeout but I didn't realise it
would generate a new one.

"Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com>
[quoted text, click to view]

AddThis Social Bookmark Button