Asp.NET cookie across subdomains not updating and not expiring

Question

I have 2 subdomains and I need to set and read the same cookie from both websites.

When I use localhost, everything works fine.

When I switch to using valid urls, the cookie infomation is not really being updated when I update it (expire date on logout).

I have the domain of the cookie set to ".mysite.com"

what is wrong?

Answer 1

Here is my code: (works fine on localhost but not subdomain, never logs the user out because the cookie doesnt get expired)

Login page:

  FormsAuthentication.SetAuthCookie(UserName.Text, true);
    // set the active collab cookie
    Member member = MemberManager.GetMemberByUsername(UserName.Text);

    HttpCookie cookie = new HttpCookie("Token", member.Profile.Token);
    cookie.Domain = ConfigurationManager.AppSettings["CookieDomain"];
    cookie.Expires = DateTime.Now.AddYears(1);
    Response.Cookies.Add(cookie);

Globax ASAX

if (HttpContext.Current.Request.Cookies["Token"] != null) {
        string token = HttpContext.Current.Request.Cookies["Token"].Value;
        if (!string.IsNullOrEmpty(token)) {
                // If the user is logged in with a different token
                // or not logged in at all
                // then log them in with the token from the cookie
                if ((MemberManager.CurrentMember != null && MemberManager.CurrentMember.Profile.Token != token) || User == null) {

                  Member member = MemberManager.GetMemberByToken(token);
                  if (member != null) {
                        FormsAuthentication.SetAuthCookie(member.User.UserName, true);
                 }
             }
                }
            }

Logout Code:

 if (Request.Cookies["Token"] != null) {
                HttpCookie aCookie = Request.Cookies["Token"];
                aCookie.Expires = DateTime.Now.AddDays(-1);
                Response.Cookies.Add(aCookie);
}

Web.Config

 <machineKey
      validationKey="0B527474607638F3659A4EC9E62E3B10F22F7E2E72B67F44D730C689EB19DF29C419D70FFB3F390F384B03AAB91F9CB489AD39101EFB64D533310721D95E2230"
      decryptionKey="82E81A96A6EA7B196079E8AB854C24698E690E8545F95DA098C37BFD1B99566E"
      validation="SHA1"
      decryption="AES" />

 <authentication mode="Forms">
      <forms name="AuthCookie"
             path="/"
             loginUrl="~/login.aspx"
             protection="All"
             timeout="60">
      </forms>
    </authentication>

Answer 2

Try this:

 if (Request.Cookies["Token"] != null) {
                HttpCookie aCookie = Request.Cookies["Token"];
                aCookie.Expires = DateTime.Now.AddDays(-1);
                Response.Cookies["Token"] = aCookie;
}

Instead of adding it, set it to the existing cookie.

Answer 3

Your forms authentication setting in the web.config needs to enable cross app redirects:

<authentication mode="Forms">
    <forms loginUrl="~/login.aspx" protection="All" timeout="960" name=".ASPXAUTH" path="/" requireSSL="false" slidingExpiration="false" defaultUrl="~/default.aspx" enableCrossAppRedirects="true"/>
</authentication>

Answer 4

The answer was to set the domain to the cookie when expiring it on logout

HttpCookie aCookie = Request.Cookies["Token"];
aCookie.Expires = DateTime.Now.AddDays(-1);
aCookie.Domain = ConfigurationManager.AppSettings["CookieDomain"];
Response.Cookies.Add(aCookie);