FormsAuthentication.SetAuthCookie not working in IE9 or Chrome

Question

Sorry if it was covered, but I'm going to pull my hair out. My site uses forms-based authentication and works fine when I test // localhost, but when I publish on the Internet, it does not work in IE9. I followed all the steps described in the tutorials, but when using IE9 or Chrome FormsAuthentication.SetAuthCookie never creates a cookie. Kicker is when I use Firefox, it works. Below is the code from my web.config and my C # code.

Basically, I take the username and password of the user and authenticate to my SQL Server with saved proc. Then return the temporary web key that the site uses to interact with the user profile. The web key is stored in the FormsAuthentication cookie as an identifier that I can get in order to validate the user logging in.

In addition, I know that cookie authentication is never created because I have an asp: loginstatus control on a page that never changes.

web.config:

<authentication mode="Forms"> <forms loginUrl="Login.aspx" protection="All" path="/" slidingExpiration="true" timeout="60" cookieless="AutoDetect" /> </authentication> <authorization> <deny users="?"/> <allow users= "*"/> </authorization> 

in the code behind:

 void LogUserIn(string UserEmail, string Pwd) { conn = new SqlConnection(connstr); sql = new SqlCommand("exec usp_AuthLogin @Email, @Pwd", conn); sql.Parameters.AddWithValue("@Email", UserEmail); sql.Parameters.AddWithValue("@Pwd", Pwd); try { conn.Open(); reader = sql.ExecuteReader(); while (reader.Read()) { Result = reader["Result"].ToString(); // value of webkey } } catch (Exception ex) { } finally { conn.Close(); } // if successful log in and create cookie if (Result != "Denied") { FormsAuthentication.SetAuthCookie(Result, true); // set cookie with webkey from sql server LoggedIn = true; } else { LoggedIn = false; } } 

Please, help

Answer 1

I'm sure you need to use the username as the first parameter in SetAuthCookie - how the FormsAuthentication module knows who the user is.

SetAuthCookie creates a ticket under the umbrella under the hood. Have you tried making your own authorization ticket? This will allow you to store additional data on it.

Explained here: http://msdn.microsoft.com/en-us/library/system.web.security.formsauthenticationticket.aspx#Y1368

basically you do it:

 FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, username, DateTime.Now, DateTime.Now.AddMinutes(30), isPersistent, //true or false webkey, //Custom data like your webkey can go here FormsAuthentication.FormsCookiePath); // Encrypt the ticket. string encTicket = FormsAuthentication.Encrypt(ticket); // Create the cookie. Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket)); 

This explains how you read the data back http://msdn.microsoft.com/en-us/library/system.web.security.formsauthenticationticket.userdata.aspx

 FormsIdentity id = (FormsIdentity)User.Identity; FormsAuthenticationTicket ticket = id.Ticket; string webkey = ticket.UserData; 

Edit: Also, the default auth cookie is used. You can use a firefox plugin like live headers to make sure it is created.