Does a forms auth ticket survive a trip to WorldPay?

Question

Hi there,

I've got a site that uses Forms Authentication (with a custom membership provider, but that's not important right now). In the secure part of the website, the customer can purchase goods and pay for them via WorldPay.

Once they come back from WorldPay, if there's a link back into the secure part of the website, can I reasonably expect the forms auth ticket (stored in a session cookie) to have survived (timeout notwithstanding)?

The ticket is set thus:

FormsAuthentication.SetAuthCookie(username, false);
FormsAuthentication.RedirectFromLoginPage(username, false);

The work is part of a redevelopment, and I would rather have a quick "yes/no/maybe" answer before writing lots of code that may not be required - we do not want to have the user log back into the secure part of the site so we recreate their login based on the information returned from WorldPay. Obviously, if the user is going to be remembered, I don't have to write that code - I'm quite lazy ;-)

Thank you for any suggestions,

Mike K.

Answer 1

Forms Authentication uses a cookie.

A session cookie (which is stored in memory) lives as long as the session does not timeout and you do not close the browser.

You may also be able to set the life time of the cookie, then it will be written to disk, and available to all browser instances. In this case you will also be logged out if the session timesout on the server.

Answer 2

If you're calling

FormsAuthentication.SetAuthCookie(username, false);

then the cookie will survive for as long as the value specified in your web.config or until the user logs-out.

If you redirect them to a 3rd-party site during the course of their visit to your site, this cookie will remain. The 3rd-party site won't have access to your auth cookie.

In short, they will still be logged-in on your site when WorldPay redirects them back.

Even shorter: yes.

Hope this helps.

Answer 3

The other answers here seem to point out to this being a non-issue, but I thought I'd just add that if you're posting data to their gateway, any variables which start with MC_ will be returned to you on the other side. I'm not sure if this helps or not!