How do I use forms authentication to enable login?

Question

I create a FormsAuthentication ticket and store it in a cookie, which I use with MVC AuthorizeAttribute to provide authorization. Right now, I have this, so the cookie does not expire if I have the “stay in the game” checkbox selected (I just change the cookie.expires to date + 1 year, for testing purposes, you checked it to stay in the record) .

However, despite the fact that I have established that the cookie is permanent, when I create a ticket, the ticket still stops working after a timeout.

Here is the code where I create AuthTicket:

var now = DateTime.UtcNow.ToLocalTime(); FormsAuthenticationTicket authTicket = new System.Web.Security.FormsAuthenticationTicket(1, username, now, now.Add(FormsAuthentication.Timeout), rememberMe, username, FormsAuthentication.FormsCookiePath); string encryptedTicket = System.Web.Security.FormsAuthentication.Encrypt(authTicket); return encryptedTicket; 

This is the same encrypted Ticket that I set as a cookie. Does anyone know how I can save this ticket until the FormsAuthentication timeout expires? Should I just vouch for the FormsAuthentication timeout?

Answer 1

The time the cookie adheres to does not coincide with how long the login remains valid. Basically, a persistent cookie is “should this cookie stick after closing the browser” and does not depend on how long this login is valid. You can use this to save the username, for example, so that the user does not have to re-enter this information when they return.

If the cookie is valid, but the username has expired in the cookie, you will need to log in again. If you want your login to last longer, you need to increase the time on the <forms> in the web.config file, or you can do it in the code, but then you need to recompile if you want to extend / shorten the expiration time.

Here are a few sites that explain these concepts a bit:

http://software-security.sans.org/blog/2012/04/05/forms-authentication-remember-me-its-hard-not-too

Cookie Confusion with FormsAuthentication.SetAuthCookie () Method