problem in asp.net on validating Session and Redirecting

Question

I m using "FormsAuthentication" in Asp.net coded in C#.net to validate the users , I m maintaining username in sessions to processing , the problem is when i copy the URL and paste in Firefox Browser its not Redirecting to Login page, But it is working fine in Case of IE browser. I m checking the sessions values and Redirecting to Login when it is not authenticated its works only for IE. I need for Firefox Browser. Could any suggest me some method.

Answer 1

do you use: if (User.Identity.IsAuthenticated)

you don't have to store it in a session. you can access the user object :)

and did you use FormsAuthentication.RedirectFromLoginPage() and/or

if (!User.Identity.IsAuthenticated)
     FormsAuthentication.RedirectToLoginPage()

if you use the login control do you have something in the code like this on the onclick of the asp:login control:

if (FormsAuthentication.Authenticate(username.Text, password.Text))
     FormsAuthentication.RedirectFromLoginPage(username.Text, true);

and something like this in the web.config:

<configuration>
  <system.web>
    <authentication mode="Forms">
      <forms loginUrl="login.aspx" protection="All" timeout="30">
        <credentials passwordFormat="Clear">
          <user name="devhood" password="password"/>
          <user name="someguy" password="password"/>
        </credentials>
      </forms>
    </authentication>
   </system.web>
</configuration>

Answer 2

If you are using FormsAuthentication, I recommend not to merge with Session. This combination gave us lot of pain in past. When you are using FormsAuthentication you can call Membership.GetUser() which will return you with the MembershipUser object of currently logged in user and if the user is not logged-in, it will return null.

So you can bind your redirect logic around this and check if the user is logged-in or not. Yes you can keep the Username in session for some other purpose.