I'm trying to learn how to do user authentication with ASP.NET. I've set up the following simple site to experiment with it, but I'm running into a login loop because my authentication seems to always return 'false'.
Here's my code:
The login page has an control named Login1.
Here's the code behind;
protected void ValidateUser(object sender, EventArgs e)
{
int userId = -1;
string connectionString = ""; // I have a connection string here that I left out of this post.
MySqlConnection conn = new MySqlConnection(connectionString);
using (conn)
{
using (MySqlCommand cmd = new MySqlCommand("Validate_User"))
{
try
{
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.AddWithValue("Username", Login1.UserName);
cmd.Parameters.AddWithValue("Pass", Login1.Password);
cmd.Parameters.Add("@ireturnvalue", MySqlDbType.Int32);
cmd.Parameters["@ireturnvalue"].Direction = ParameterDirection.ReturnValue;
cmd.Connection = conn;
conn.Open();
cmd.ExecuteScalar();
userId = Convert.ToInt32(cmd.Parameters["@ireturnvalue"].Value.ToString());
switch (userId)
{
case -1:
Login1.FailureText = "DB call failed, contact System Admin.";
break;
case 0:
Login1.FailureText = "Username and/or password is incorrect.";
break;
case 1:
FormsAuthentication.SetAuthCookie(Login1.UserName, false);
FormsAuthentication.RedirectFromLoginPage(Login1.UserName, Login1.RememberMeSet);
break;
case 2:
firstLogin = true;
FormsAuthentication.SetAuthCookie(Login1.UserName, false);
FormsAuthentication.RedirectFromLoginPage(Login1.UserName, Login1.RememberMeSet);
break;
}
}
catch (Exception ex)
{
lblError.Text = ex.ToString();
}
finally
{
cmd.Dispose();
conn.Close();
}
}
}
}
I've tested that the login is successful and with my test user we end up at 'case 2' in the switch statement. From my understanding, this should set up the cookie and then redirect the user back to the page they were trying to go to.
In this case, that would be my Members.aspx page:
protected void Page_Load(object sender, EventArgs e)
{
if (!this.Page.User.Identity.IsAuthenticated)
{
FormsAuthentication.RedirectToLoginPage();
}
}
So this should detect if the user is authenticated and if they're not, redirect them to the login page. Here's where the issue arises, as this always returns false and so always redirects back to the login page.
Here are some additional settings I know are important based on the related questions:
In Web.config:
<authentication mode="Forms">
<forms defaultUrl="~/Default.aspx" loginUrl="~/Login.aspx" slidingExpiration="true" cookieless="UseCookies" timeout="2880"/>
</authentication>
Also:
<modules>
<remove name="FormsAuthenticationModule" />
<remove name="FormsAuthentication" />
</modules>
Some people have suggested also adding the following to Web.config, but I run into a 'localhost redirected you too many times' error when I add it:
<authorization>
<deny users="?"/>
</authorization>
I've tried a number of suggestions on related questions, many of which have me tinker with some Web.Config setting (such as the setting) or a few that are using the Membership.ValidateUser function, which isn't what the tutorial I followed had me do.
For reference, here's the tutorial I followed: ASP.NET Authentication Tutorial.
I suspect that I'm doing something wrong with authenticating, but I'm not sure what else should be done besides using the FormsAuthentication.SetAuthCookie(Login1.UserName, false) method.
Any help is very much appreciated!