WebForms Asp.Net Authentication

Hi,
I'm pretty new developing .Net applications. I would like your advice on the authentication matter. We still don't know what practice is better for managing sessions.

Currently, we have developed webForms that validate using 'sessions ' on every page.
Second, we have developed pages that use 'Cookies'
Third and Final, we have added an "authentication mode = "forms" in the web.config file.

All of them programatically defined to last 60 minutes.
Finally, after a user clicks the signout button, the user can still get connected :(
LVL 2
José PerezAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Miguel OzSoftware EngineerCommented:
When you logout:
Q1. Did your code clear the Session object?
Q2. Did your code call FormsAuthentication.SignOut and redirect to login page? (See sample on link provided)
0
David Johnson, CD, MVPOwnerCommented:
in the logout procedure - clear the cookie. or set the cookie as logged out
0
José PerezAuthor Commented:
This is the code:

TheSystem FORM

using System;
using System.Data;
using System.Web;
using System.Web.Security;

namespace TheSystem.loginOn
{
    public partial class index : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            if ((System.Web.HttpContext.Current.User != null) && System.Web.HttpContext.Current.User.Identity.IsAuthenticated)
            {
                FormsAuthentication.SignOut();
                Response.Redirect("~/Leave.html", true);
            }
        }

        protected void Validate_Click(object sender, EventArgs e)
        {
            FormsAuthentication.SignOut();

            string rut = this.login.Text.Replace(";", "").Replace("--", "");
            string contraseña = this.pass.Text.Replace(";", "").Replace("--", "");

            if (LoginService.Autenticar(rut, contraseña) == true)
            {
                //Se verifica en la base de datos el UsuarioID y se almacena en la variable tblUsuario.
                DataTable tblUsuario = LoginService.prConsultaUsuario(rut, contraseña);

                //se declara y se le da el valor a la variable de sesión UsuarioID
                Session["userId"] = tblUsuario.Rows[0]["id"].ToString();
                Session["userName"] = tblUsuario.Rows[0]["name"].ToString();
                Session["userPerf"] = tblUsuario.Rows[0]["perf"].ToString();
                Session["time"] = DateTime.Now;
                Session.Timeout = 60;               
                ////Manda a la principal en caso de ser correcto el login
                ////Response.Redirect("~/");

                FormsAuthenticationTicket tkt = new FormsAuthenticationTicket(1,
                                                    Session["userName"].ToString(),
                                                    DateTime.Now,
                                                    DateTime.Now.AddMinutes(60),
                                                    false,
                                                    Session["userPerf"].ToString(),
                                                    FormsAuthentication.FormsCookiePath);

                Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(tkt)));

                string strRedirect = Request["ReturnUrl"];
                if (strRedirect == null)
                {
                    strRedirect = "~/Views/ClientCall.aspx";
                }
                Response.Redirect(strRedirect, true);
            }
            else
            {
                //Mensaje de error en caso de no ser usuario registrado
                lblMensaje.Text = "Usuario o Contraseña Incorrecto";
            }
        }
    }
}

Open in new window

WEB.CONFIG

    <authentication mode="Forms">
      <forms loginUrl="Login/default.aspx" 
             name=".TheSystem" 
             timeout="60"
             defaultUrl="default.aspx"
             protection="All"
             path="/"
             requireSSL="false"
             slidingExpiration="true"
             cookieless="UseDeviceProfile"
             domain="" 
             enableCrossAppRedirects="false">
             <credentials passwordFormat="SHA1" />
      </forms>
      <passport redirectUrl="internal" />
    </authentication>

Open in new window


GLOBAL.ASAX


        protected void Application_AuthenticateRequest(object sender, EventArgs e)
        {
            if (HttpContext.Current.User != null)
            {
                if (HttpContext.Current.User.Identity.IsAuthenticated)
                {
                    if (HttpContext.Current.User.Identity is FormsIdentity)
                    {
                        FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;
                        FormsAuthenticationTicket ticket = id.Ticket;

                        // Get the stored user-data, in this case, our roles
                        string userData = ticket.UserData;
                        string[] roles = userData.Split(',');
                        HttpContext.Current.User = new GenericPrincipal(id, roles);
                    }
                }
            }

Open in new window

0
CompTIA Network+

Prepare for the CompTIA Network+ exam by learning how to troubleshoot, configure, and manage both wired and wireless networks.

Miguel OzSoftware EngineerCommented:
Please post the logout code as well and any other event related to logout in Global.asax
0
José PerezAuthor Commented:
In page_Load it is writen the logout:
FormsAuthentication.SignOut();

Open in new window


by the way, nothing else in Global.Asax
0
Miguel OzSoftware EngineerCommented:
As per my previous post you have to clear session, sign out and redirect:
 Session.Clear();
 FormsAuthentication.SignOut();
 FormsAuthentication.RedirectToLoginPage();

Open in new window

Also please remove web.config line 17 (<passport redirectUrl="internal" />), Forms and passport Authentication are mutually exclusive.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
C#

From novice to tech pro — start learning today.