What am I doing wrong with my FormsAuthenticationTicket?

Question

Hi

I am trying to recreate my cookie what would be normally generated by FormsAuthentication.SetAuthCookie() and what is in the webconfig.

<authentication mode="Forms">
      <forms loginUrl="~/Account/LogOn" protection="All" timeout="20160" name=".ASPXAUTH" path="/" requireSSL="false" slidingExpiration="false" defaultUrl="default.aspx" cookieless="UseDeviceProfile" enableCrossAppRedirects="false"/>
     </authentication>

However I want to send one more piece of data along so as far as I understand I have to make my own FormsAuthenticationTicket to add this data(or merge it all with the userName in SetAuthCookie and do splitting).

So I am trying to get it as secure(or more secure) as the one it makes from the webconfig, have the same values as the one generated from the webconfig.

So this is what I have so far

 FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, "chobo2", DateTime.Now, DateTime.Now.AddYears(10), true, "test");
            string encTicket = FormsAuthentication.Encrypt(ticket);
            Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));

However I am still not sure what it is using. Does it use stuff from the webconfig? Since it does not ask for a cookieName nor a timeout.

When I look at this cookie through web developer it says it not secure, and that it expires in the end of session.

When I look at the one generated from the webconfig it has a expiry date of like october 12th and still says not secure(guess it is refering to SSL).

Also I am still confused about the userData. How do I add I grab this value later on? How do I add more then once peice of data?

Do I always have to decrypt(ie call the decrypt method) to decrypt the cookie or does it do it automatically.

What kind of encryption is the cookie using by default anyways?

Thanks

Answer 1

You need to manually set all of those properties on the forms authentication ticket. You can access most of the the values via static accessors on the FormsAuthentication class. The configuration settings in the web.config are only used when you use FormsAuthentication.GetAuthCookie or FormsAuthentication.SetAuthCookie.

User data can be retrieved by extracting and decrypting the forms authentication ticket then using the UserData property accessor on the decrypted ticket.

You will always need to decrypt the ticket to access the user data.

http://msdn.microsoft.com/en-us/library/ms998310.aspx contains details on the encryption and validation ciphers used, but by default the ticket is encrypted using AES and validated using SHA1 (HMACSHA1).

http://support.microsoft.com/kb/910443 contains a further information and links that may answer any further questions you have.