CODEWITHSUNDEEP
asp.net-mvccookies
a.b
a.b

Reputation: 27

Can I change the FormsAuthentication cookie name in asp.net dynamically?

I want to set FormsAuthentication cookie name dynammically, for example a guid. how can i do that. I can already change it to whatever I want in web.config. I just can't do it in code and dynamically.Please help.

<authentication mode="Forms">
  <forms name="myName" loginUrl="~/Account/Login" defaultUrl="~/Admin/admin" cookieless="UseCookies" slidingExpiration="true"  timeout="40320"/>
</authentication>

The reason that I want to do this is, i have several instances of my application on the same host and i do not want them to overwrite each other's cookies.

Upvotes: 2

Views: 3202

Answers (2)

Ashish Mehta
Ashish Mehta

Reputation: 81

I have been struggling with Cookies with quite a few days. It has been an awesome learning experience.

So wanted to share the possible ways I found & discovered: There are several HACKs to modify Forms Authentication Cookie name:

  1. You can automate the modification of cookie name under Authenticaiton secion of Web.Config file in Application_Start event in Global.asax. Thanks to Ron for sharing this. But I could not guarantee that the user whose identity would be used to run application domain have enough privileges to modify the file on disk or not. Hence I needed an improvised solution, so I devised following.

  2. Thanks to ILSpy for letting me see inside the FormsAuthentication class, and many thanks to Reflection to let me modify the private field of a class. I used following code to modify the cookie name on run-time with following small piece of code and this worked like a charm !!! 

    protected void Application_Start(Object sender, EventArgs e)
    {
        // This will enforce that FormsAuthentication class is loaded from configuration settings for the application.
        FormsAuthentication.Initialize();

        // The new cookie name whatever you need can go here, I needed some value from my application setting to be prefixed so I used it.
        string newCookieName = string.Format("{0}.ASPXAUTH", ConfigurationManager.AppSettings["SomeSettingThatIsUniquetoSite"]);

        // Modifying underlying baking field that points to FormsAuthentication.FormsCookieName         
        Type type = typeof(FormsAuthentication);
        System.Reflection.FieldInfo field = type.GetField("_FormsName", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static);
        field.SetValue(null, newCookieName);
    }

Suggestions, loopholes are requested as this is my first answer on this forum.

Upvotes: 5

James
James

Reputation: 7533

You can't do this in code; the property FormsAuthentication.FormsCookieName is readonly. I would use the following configuration in web.config:

<authentication mode="Forms">
  <forms configSource="forms.config" />
</authentication>

Then give each instance of the application its own forms.config:

<forms name="CookieNameForThisInstance" />

Upvotes: 1

Related Questions