Asp.net Remember Me no longer works with forms authentication

I have two websites with authorized membership providers that are hosted on the same server on the same Web in different web applications and different application pools.

I used to have a problem that I couldn’t log in to both sites together. Thanks to the Remy post , this now works, I had to add the name attribute to the forms element.
But now I had a problem that the remember-me option of asp login-control stopped working. The user is disconnected after a normal session timeout.

The authentication attributes in the web.config file are as follows:

 <authentication mode="Forms" > <forms loginUrl="~/UserMgmt/Login.aspx" timeout="400000" slidingExpiration="true" name="NameOfTheSite"/> </authentication> 

I also set a cookie name for auto-mode forms for different names.

Is there anything else I need to add for the mem-me function to work?

Update
I noticed that if I turn off encryption and verification for authentication cookies, the problem goes away. If I either activate encryption, verification, or both, the problem arises again.
I also know that it does not depend on cookie names (they can even be identical). Maybe this information helps someone understand what is happening?

Update 1
Thanks to Jason Keely for solving this problem. I would never have found it. In the meantime, I found the relevant information in msdn. In How to configure MachineKey in ASP.NET 2.0 , the "Web farm deployment considerations" section says:

If you want to isolate the application from other applications on the same server, put <machineKey> in the Web.config file for each application on each server in the farm. Make sure you use separate key values ​​for each application, but duplicate each application key on all servers in the farm.

+8
forms-authentication asp.net-membership
source share
3 answers

The problem may be that you have validation keys that are automatically generated each time the workflow starts. The cookie is encrypted, but when you return, a new server key is used, and therefore your cookie cannot be decrypted.

Check machineKey section http://msdn.microsoft.com/en-us/library/ff649308.aspx

Here is what the machineKey section will generate for you http://www.qualitydata.com/products/aspnet-membership/help/configuration/no-machinekey.aspx

+9
source share

Try setting the domain name to make sure that the cookie is remembered correctly in all cases.

 <forms path="/" domain="nameof.com" ...the rest 
+2
source share

The cookie timeout is also limited by IIS and defaults to at least 20 minutes. To change this:

  • Open IIS Manager.
  • Right-click on your site and select properties.
  • Select the ASP.NET tab and click Change Configuration.
  • Select the Authentication tab.
  • Select Enable Expiration.
  • Set Cookie timeout to a longer cost. To set the value to 30 days, enter 30.00: 00 :. 00
  • Click OK and exit IIS Manager.

enter image description here

0
source share

Source: https://habr.com/ru/post/651222/


All Articles