dealing with authentication in asp.net using membership

Question

Ok, here is the problem:

I have two sites: www.mysite.com and blog.mysite.com (fake site names) which suppose to share authentication. The login page is on www.mysite.com/login/login.aspx

Now, the blog website has web.config with following authentication section:

<authentication mode="Forms">
  <forms timeout="50000000" 
   loginUrl="http://www.mysite.com/login/login.aspx"
   defaultUrl="~/"/>
</authentication>
<authorization>
   <deny users="?"/>
</authorization>

Now I hit blog.mysite.com/andrey/page.aspx and it redirects me to login page which is on www site. The real problem is that "reditect" query string will only contain relative page url (andrey/page.aspx), so when I login it will try to redirect me to www.mysite.com/andrey/page.aspx, not blog.mysite.com/andrey/page.aspx where i started so of course everything fails.

Is there a way to tell Membership object to put the full path into "redirect" query string parameter when it bounces to login page?

Thanks! Andrey

Answer 1

Assuming that each domain has its own web.config, I think this might work.

1) Create a login page for both www.mysite.com and blog.mysite.com
2) Point both to the same membership database
3) Make sure both have the same membership applicationName attribute set:

<membership><providers><add applicationName="mySite">

4) Make sure both have the same forms name set:

<authentication mode="Forms"><forms  name="mySite">

This should ensure that both sites use the same membership database and the same authentication cookie, but they'll use their individual login pages and so the return url should be fine.

---

Can you call the FormsAuthentication.SetAuthCookie Method and manually redirect to the http referrer?

---

I just saw this in the documentation for FormsAuthentication.RedirectFromLoginPage

By default, the ReturnUrl variable must refer to a page within the current application. If ReturnUrl refers to a page in a different application or on a different server, the RedirectFromLoginPage method redirects to the URL in the DefaultUrl property. If you want to allow redirects to a page outside the current application, you must set the EnableCrossAppRedirects property to true using the enableCrossAppRedirects attribute of the forms configuration element. Security noteSecurity Note:

Setting the EnableCrossAppRedirects property to true to allow cross-application redirects is a potential security threat. When cross-application redirects are allowed, your site is vulnerable to malicious Web sites that use your login page to convince your Web site users that they are using a secure page on your site. To improve security when using cross-application redirects, you should override the RedirectFromLoginPage method to allow redirects only to approved Web sites.

Does messing with that property help at all?