Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

ASP.net Single Sign On

Posted on 2010-09-20
2
Medium Priority
?
383 Views
Last Modified: 2012-06-21
I have set up 2 websites on the same domain at the moment (for example,   test.mainsite.com/site1 and test.mainsite.com/site2).

I have been trying to achieve an SSO between them and think that I have it working, but I want to make sure that I am not creating any security holes.  I will highlight the changes I made to each application and ask for advice/comments:

Both web.configs have a machine key defined with the same validationKey, decryptionKey, and validation.

Both web.confgs have the same forms authentication definition.
 <authentication mode="Forms">
 <forms timeout="1440" loginUrl="~/Login.aspx" name="formscookiename1" path="/"/>
 </authentication>

On the login page of my site 1, I create the Formauth and cookie as such:

FormsAuthenticationTicket ticket = new  FormsAuthenticationTicket( loginname, true, 720 );
string strEncrypted = FormsAuthentication.Encrypt( ticket );
            HttpCookie hc = new HttpCookie( FormsAuthentication.FormsCookieName, strEncrypted );
hc.Expires = DateTime.Now.AddHours( 8);
Response.Cookies.Add( hc );


What I found is that as long as the machinekey info is the same, and the formscookie name is the same, I was able to login to site 1 and automatically be logged into site 2 when I hit that site.

Also, the logout page with this code in it;
FormsAuthentication.SignOut();                   

successfully signed out of both sites.


My question really is then, have I done this right?  Are there any mistakes made here that would open up a security hole in the 2 sites (i.e can cookies be copied etc..).

Thanks.
0
Comment
Question by:MikeCausi
2 Comments
 
LVL 41

Accepted Solution

by:
guru_sami earned 2000 total points
ID: 33717379
What you have done is fine and that's how it is done.
0
 

Author Closing Comment

by:MikeCausi
ID: 33717422
Thanks for the confirmation.  
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Just a quick little trick I learned recently.  Now that I'm using jQuery with abandon in my asp.net applications, I have grown tired of the following syntax:      (CODE) I suppose it just offends my sense of decency to put inline VBScript on a…
Introduction Hi all and welcome to my first article on Experts Exchange. A while ago, someone asked me if i could do some tutorials on object oriented programming. I decided to do them on C#. Now you may ask me, why's that? Well, one of the re…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Loops Section Overview

926 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question