CODEWITHSUNDEEP
c#asp.netasp.net-mvcasp.net-mvc-4forms-authentication
Dan
Dan

Reputation: 9847

.ASPXAUTH Cookie Not Found in Request.Cookies

I am creating a web application that is hosted under a web site with forms authentication enabled. I have a role in my authentication database "Admins". Here is my controller code:

[RequireHttps]
[Authorize(Roles = "Admins")]
public ActionResult Index()
{
  return this.View();
}

When I go to the Index page, if I'm not authenticated, it redirects me to the login page where I enter my credentials. The login page then redirects back to Index page of the new app, but the controller doesn't recognize that the user is authenticated.

I have taken the Authorize attribute off and looked at the request as it went out in the Chrome developer console and confirmed that the cookie is indeed being sent. But if I leave the Authorize attribute as is, and go to the Index page, the cookie collection on the request in my controller is empty. The headers collection contains a header entitled "Cookie", and the value of the header contains the .ASPXAUTH cookie.

The login page calls logs in with this code:

FormsAuthentication.SetAuthCookie(userName, remember, "/");

This behavior is reproducible in all major browsers.

What can I do to cause the Cookies collection of the request to be populated?
What do I need to do to make the application realize that the user really is authenticated?

Edit:
I still don't have it working, but I'm pretty sure it's something to do with the ASPXAUTH cookie being filtered.

Upvotes: 3

Views: 3237

Answers (2)

Dan
Dan

Reputation: 9847

I'm sure there are multiple causes of this problem. In my case, the problem was that the version of MVC I was using to write the cookie was different from the version that was decrypting it. I changed my sites to all be running MVC 4, and the cookie that was created by one site was consumable by the other site.

Upvotes: 1

nickytonline
nickytonline

Reputation: 6981

Is the .ASPXAUTH cookie generated a secure cookie, i.e. SSL? If so and your Index.aspx is only over HTTP not HTTPS, you will not see the cookie in the collection.

Upvotes: 0

Related Questions