FormsAuthentication class c#

Question

If I call FormsAuthentication.SetAuthCookie("john", true), is the users name stored in the cookie?

What I'm trying to find out is if the users session times out and then the user revisit the site again, Request.IsAuthenticated is set to true, but where is the users name coming from?

Answer 1

Session timeout and authentication timeout are two separate things. You can have sessions time out without invalidating the authentication.

Yes, the user's name is stored in the authentication cookie. It is encrypted, however.

Answer 2

You can use your browser to examine the content of your cookies. For example my stack over flow cookie looks like:

F650CE82F53D2C39C8C06B5F26EB34E20FEAC3585035E2A6E9FA30B8ECF5051F4D9C8....

The value is an encrypted goo of a username and potentially the user roles.

The cookie is good as long as you want it to be. It isn't tied to the session.

In your sample code you created a persistent cookie, so it lives for the life of the cookie, even if you close your browser. Now if the cookie is memory based, it lasts until you close your browser, even if the expiration time would let it live longer.

Here are the default values:

<forms loginUrl="Login.aspx"
           protection="All"
           timeout="30"
           name=".ASPXAUTH" 
           path="/"
           requireSSL="false"
           slidingExpiration="true"
           defaultUrl="default.aspx"
           cookieless="UseDeviceProfile"
           enableCrossAppRedirects="false" />

Answer 3

As from this MSDN page it sets forms-authentication ticket to either cookies or in URL if CookiesSupported is set false.

When you set second argument as true, the cookie is persistent so when user visits second time (after session timesout) your app gets the cookie with auth-ticket and so it get the user details (as far as I think).

If you don't want to make this happen I think either setting the second argument to false:

FormsAuthentication.SetAuthCookie("john", false);

or explicitly clearing the ticket (and so cookie):

FormsAuthentication.SignOut();

will work for you.