1

I have an asp.net single page web application.

When the user enters to me web application , it gets a login screen with username password and I make an ajax call for authentication:

        FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
                    "CookieName",
                    DateTime.Now,
                    DateTime.Now.AddMinutes(1),
                    true,
                    "data",
                    FormsAuthentication.FormsCookiePath);

        // Encrypt the ticket.
        string encTicket = FormsAuthentication.Encrypt(ticket);

        HttpContext.Current.Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));

Before any ajax call I check if the request and the user are authenticated:

if (HttpContext.Current.Request.IsAuthenticated)
{
    if (HttpContext.Current.User.Identity.IsAuthenticated)
    {
             //do something
    }
}

but when the cookie is expired, I still get "true" for both conditions.

Why? Is it because I make an ajax call? Should I check if the cookie expired before every call instead of using IsAuthenticated?

7
  • How often are you making the AJAX call? What kind of AJAX call? How did you check that the cookie is expired?
    – Alexander
    Jul 8, 2013 at 12:57
  • Hi @Alexander I have a lot of ajax calls in order to bring data relevant for the specific user, that's why I have to check that the user is authenticated
    – Inbal
    Jul 8, 2013 at 12:59
  • In what intervals are they called? I suspect that "sliding expiration" is preventing the authentication from expiring. That's why I asked how you checked if the cookie was expired?
    – Alexander
    Jul 8, 2013 at 13:36
  • Are you sure your Ajax calls are not cached by the browser so that actually it reads the value from the browser's cache? Jul 8, 2013 at 13:56
  • @Alexander I use this code: HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName]; FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value); and then I check IsExpired of authTicket
    – Inbal
    Jul 8, 2013 at 14:52

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.