¿Cómo puedo crear manualmente una cookie de autenticación en lugar del método predeterminado?

Usar FormsAuthentication we write code like this:

 if (IsValidUser())
      FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);
      FormsAuthentication.RedirectFromLoginPage(userName, createPersistentCookie); 
  1. How can I manually create a authentication cookie instead of writing FormsAuthentication.SetAuthCookie(userName, createPersistentCookie)?

  2. How can I store a redirect URL from the login page in a string variable instead of writing FormsAuthentication.RedirectFromLoginPage(userName, createPersistentCookie)?

preguntado el 27 de agosto de 11 a las 20:08

2 Respuestas

Here you go. ASP.NET takes care of this for you when you use the higher level methods built into FormsAuthentication, but at the low level this is required to create an authentication cookie.

if (Membership.ValidateUser(username, password))
  // sometimes used to persist user roles
  string userData = string.Join("|",GetCustomUserRoles());

  FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
    1,                                     // ticket version
    username,                              // authenticated username
    DateTime.Now,                          // issueDate
    DateTime.Now.AddMinutes(30),           // expiryDate
    isPersistent,                          // true to persist across browser sessions
    userData,                              // can be used to store additional user data
    FormsAuthentication.FormsCookiePath);  // the path for the cookie

  // Encrypt the ticket using the machine key
  string encryptedTicket = FormsAuthentication.Encrypt(ticket);

  // Add the cookie to the request to save it
  HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
  cookie.HttpOnly = true; 

  // Your redirect logic
  Response.Redirect(FormsAuthentication.GetRedirectUrl(username, isPersistent));

I'm not sure why you would want to do something custom here. If you want to change the implementation of where user data is stored and how users authenticate then it's best practice to create a custom MembershipProvider. Rolling your own solution and messing with the authentication cookie means a high probability of introducing security holes in your software.

I don't understand your part 2. You only need to call FormsAuthentication.GetRedirectUrl if you want to return users to the page they were trying to access when they got bounced to login. If not do whatever you want here, redirect to a url stored in the configuration if you want.

To read the FormsAuthentication cookie, normally you would hook the AuthenticateRequest event in a HttpModule or the Global.asax and set up the user IPrinciple contexto.

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
    HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
    if(authCookie != null)
        //Extract the forms authentication cookie
        FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);

        // If caching roles in userData field then extract
        string[] roles = authTicket.UserData.Split(new char[]{'|'});

        // Create the IIdentity instance
        IIdentity id = new FormsIdentity( authTicket );

        // Create the IPrinciple instance
        IPrincipal principal = new GenericPrincipal(id, roles);

        // Set the context user 
        Context.User = principal;

Respondido 14 Abr '15, 14:04

ur answer helps me...can u please what code i need to write to read the content of authentication cookie after authentication. FormsAuthentication.SetAuthCookie(userName, createPersistentCookie); SetAuthCookie create a authentication cookie and i need to write the content of that cookie from server side? can u help please. thnx. :) - Thomas

can we create a form authentication cookie from client side using jquery? - Thomas

I've updated to show also how you can also read the cookie. No you can't set this from client-side as it would be a security risk and you wouldn't be able to perform the encryption which requires server-side keys. The auth cookie should always be HttpOnly. The only way would be to make an AJAX request and let the cookie be set server-side, in which case you need to ensure you are passing any credentials over SSL. - TheCodeKing

You can set HttpOnly on the cookie instance before it's saved. Updated to reflect best practice :) - TheCodeKing

This was a big help, thanks. The only change I would make would be to get the expiryDate timeout minutes from the web.config. Change DateTime.Now.AddMinutes(30) to DateTime.Now.AddMinutes(FormsAuthentication.Timeout.TotalMinutes) - LawMan

Answer Update on number of down votes casted for this post, Properway of creating a cookie with user information as follows,

Cookie validation on page load of login page,

if (HttpContext.Current.User.Identity.IsAuthenticated)

Cookie creation during authenticated user Login,

 FormsAuthentication.SetAuthCookie(txtUserName.Text.Trim(), true);
 FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
   (chkRemember.Checked) ? DateTime.Now.AddHours(6) : DateTime.Now.AddHours(2),// Specify timelimit as required
string encryptedTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
cookie.Expires = (chkRemember.Checked) ? DateTime.Now.AddHours(6) : DateTime.Now.AddHours(2);
cookie.HttpOnly = true;

Below is a Down voted answer - Reason adding an encrypted password in a cookie.

the other way of creating a cookie,

HttpCookie toolCookie = new HttpCookie("xyz");
toolCookie["UserName"] = userName;
toolCookie["Password"] = StringCipher.Encrypt(password, "#!");
toolCookie.Expires = DateTime.Now.AddMinutes(chkRemember.Checked ? 30 : -30);


Get the Existing cookie details

HttpCookie user = Request.Cookies["xyz"];
if(user != null)
  string username = user["UserName"];
  string password = user["Password"] != null ? StringCipher.Decrypt(user["Password"], "#!")

here Datasecurity is a static class.

Encrypt and Decrypt function Encrypt & Decrypt

Respondido el 07 de diciembre de 18 a las 10:12

Never put the password in a cookie. This defeats the whole point of secure cookies - No amado

could you suggest me optimum solution for the same - Pranesh Janarthanan

can you check this example.. aspsnippets.com/Articles/… - Pranesh Janarthanan

No es la respuesta que estás buscando? Examinar otras preguntas etiquetadas or haz tu propia pregunta.