4

I have an asp .net webforms app that uses forms authentication. For a small number of users we have a problem where they log in, they navigate to a couple of pages and then they are asked to log in again. Once logged in for a second time they seem to be able to stay logged in as expected. They shouldn't be asked to login the second time.

This is a single server, no web farms, nothing tricky.

This only happens to a few users, but it does seem to be all users from the same building. I am unable to replicate this and at this point might even start to deny that t was happening if one of our trainers hadn't watched it happen to a couple of customers.

Has anyone else seen anything like this?

I am also seeing a lot of "Membership credential verification failed." errors in the event log. This may be related, but all the googling I've done seems to point to web farms and the like, not a single server.

UPDATE

  1. There is no proxy server, the IIS server and the browser (IE8) are both on the same machine.
  2. The AV software installed is Symantec Endpoint, on one machine, on the other the user didn't have any AV at all (AV Fail!).
  3. The browser is IE 8 with no frills, not a single addin that didn't come with the default installation.
  4. Both session and user login time-outs are set to 30 mins and the problem happens within 1 min of the user logging on.
  5. Logging shows the user to only have one IP address.
  6. I have tried the sessionMode in all it's variations, this doesn't seem to make any difference.
2
  • Are your users accessing this site through the internal network (an Intranet site) or or through the Internet? Are they using a VPN product if it's internal and they are remote?
    – Jeff Siver
    Sep 25, 2009 at 11:55
  • Currently the site is a demo site, so the browser and the server are all on the same laptop. Sep 28, 2009 at 8:18

8 Answers 8

5
+100

Something has to be causing ASP.NET to think these users have new sessions or their authentication cookie is getting invalidated. Here a a few things I can think to check:

  1. Are the users accessing the site through a proxy server? One of our customers has a proxy that will sometimes close all open connections causing ASP.NET to see the session as new.
  2. Could an overly agressive anti-virus, anti-spyware product be "eating" the session authentication cookie?
  3. Do they have a cookie manager browser add-in that is causing the authentication cookie to disappear or change?
  4. Sounds basic but I've seen this happen because of site timeouts being set too short. If the user sits on the page for longer than the timeout, they will be forced to logon again. And this could be specific to a page when that page presents a large amount of data that takes a while for them to go through.

One other thing I just thought of, have you allowed multiple worker processes for the ASP.NET process (aka web gardens)? If so, the same constraints as with a web farm would apply for authentication.

5
  • A good series of questions, but sadly the answer is no, nope, no and it happens within 10 seconds and the session and user logged on are both set around 30 mins. Sep 22, 2009 at 7:13
  • I just re-read the last bit of your answer, multiple worker processes, how are the configured, more importantly, how can I turn them off to test? Sep 22, 2009 at 7:29
  • How you turn off the multiple worker processes differs a little for IIS6 & 7. In 7, go to the Application Pool for your site, open advanced settings, and make sure that the "Maximum Worker Processes" value is set to 1. More than 1 could cause this problem.
    – Jeff Siver
    Sep 25, 2009 at 2:42
  • I've looked at that and it is set to one. However, I did notice that in the default app pool I have multiple applications with the same name. I wasn't expecting to see that. Might that be related? Sep 28, 2009 at 8:23
  • @ilivewithian, Yes, I believe that can cause your problem. If you have multiple applications with the same name, they will use the same Form Authentication cookie/ticket name. But if they have different authenication methods (if they don't share the encryption values which, by default, they don't), your authentication ticket issued by one app will be invalidated by the other app.
    – Jeff Siver
    Sep 28, 2009 at 12:03
2

Crack open Fiddler from the problem user's PC and see what's getting passed in the headers. My bet is on a proxy server and or networking issue.

1

Are the users possibly coming from a dynamic ip address? I've seen problems where the users sessions get messed up because the IP address that they're accessing the site from changes for some reason.

2
  • That's possible, but another app on the same server accessed from the same building doesn't (to my knowledge have the same problems). I will however go digging through the logs to see if that's the issue. Aug 20, 2009 at 14:58
  • I have seen some odd things when users have 2 adsl connections. Aug 20, 2009 at 21:29
1

Are the people this is happening using a browser that's somehow different (different browser, different version, different extensions)? That could be a clue.

In general, when the problem is somewhat reproducible or at least predictable, I use Http Fiddler. Install it on a client machine, turn it on, and start browsing (this works via a system proxy - so it'll work for firefox, IE and any other proxy-supporting browsers alike). Fiddler will record all http traffic between client and server, and you can then peruse such a session later on to find any oddities.

It's a long shot, but one thing I've seen happen occasionally that can lead to these sorts of unpredictable errors is scripting parallelization issues: sometimes buttons + links have onclick handlers which cause a post-back. If you have several such handlers that fire on the same event - in particular when the default event still fires additionally to your custom onclick or whatnot - you may be causing several postbacks when it appears to be just a single postback. That can cause all kinds of unpredictable weirdness as it's not entirely clear which request ends up "winning" - and some odd errors may cause a session to terminate. Since this behaviour is very browser + network latency sensitive, it seems quite unpredictable when it occurs.

0
1

Delete the cookie on the client PC's that are playing up

0

ASP.NET Forms Authentication can redirect users to the login page if they do not have the credentials to access a specific page. It does this so that users who may have more than one login are given the opportunity to login with another account which may have the appropriate access. Basic question I know, but are the users using the same credentials the second time they log in?

0

Its possible that you have don't have specifically specified asp.net to use cookie based session but are allowing either cookie or cookieless sessions.

In the later case the session id is embedded in the Url. The type of issues you are experiences might be explained by that. Basically depending on how you define your links, some of them would not get the session id, so the user would get a new session when using those links - or maybe during a redirect. That could explain why at specific parts of your site the users loose their session.

If you have the mixed mode enabled, try setting it to only cookieless and go through your site.


Update: Based on the extra info posted there is surely more info needed for it. Some extra things to check:

  • Are you using subdomains, if that's the case the cookie might not be configured to allow that and that doesn't fail in all environments.
  • If you are using in-process session, make sure there isn't a bug in the application causing it to restart the process
  • Maybe what's causing it to ask for login again is an authorization check, and you have an issue on some roles related code
  • Is it possible that the user is just opening a separate window? ;)
0

To rule out the possibility of the browser or a browser addon messing things up, have you checked their User Agent strings? If they are randomly distributed it might not cause the problem, but if they're all the same, this might be a hint too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.