Forcing .net Login control to make the user logout if a cookie is null..

Question

I have a code base web application that is connected to 2 databases. Depending on which login control a user uses to login, a different database is connected to the code. I am doing all of this by a cookie. This cookie is in a public class called AuthenticatedUser. The class looks like this:

public class AuthenticatedUser : System.Web.UI.Page
{
    public static string ConnectionString
    {
        get
        {
            HttpCookie myCookie = HttpContext.Current.Request.Cookies["connectionString"];
            return GetConnectionStringFromName(myCookie);
        }
        set
        {
            if (HttpContext.Current.Request.Cookies["connectionString"] != null)
            {
                ExpireCookies(HttpContext.Current);
            }
            var allCookies = HttpContext.Current.Request.Cookies.AllKeys;
            HttpCookie cookie = new HttpCookie("connectionString");
            cookie.Value = value;
            cookie.Expires = DateTime.Now.AddYears(100);
            HttpContext.Current.Response.Cookies.Add(cookie);
        }
    }

    private static string GetConnectionStringFromName(HttpCookie myCookie)
{
    try
    {
        string connectionStringName = myCookie.Value;
        return ConfigurationManager.ConnectionStrings[connectionStringName].ConnectionString;
    }
    catch
    {
       FormsAuthentication.SignOut();   
    }
     finally
    {
         HttpContext.Current.Response.Redirect("/default.aspx");
    }
    return "";

}        private static void ExpireCookies(HttpContext current)
    {
        var allCookies = current.Request.Cookies.AllKeys;
        foreach (var cook in allCookies.Select(c => current.Response.Cookies[c]).Where(cook => cook != null))
        {
            cook.Value = "";
            cook.Expires = DateTime.Now.AddDays(-1);
            current.Request.Cookies.Remove(cook.Name);
            cook.Name = "";
        }
    } 
}

This seems to be working on my development machine, but when I tried to deploy it, any user that was using the "remember me" option on the site was getting a null reference error because they did not use the login control to obtain the cookie.

What is the best method to get around this? I was thinking if a user was logged in but the AuthenticatedUser class could not get a Connectionstring to log out the user to force them to use the login control again. What should I do?

Answer 1

Try use:

try  
{  
      FormsAuthentication.SignOut();  
}  
finally  
{  
      Response.Redirect("~/Home.aspx");  
}

This way is preferable, for example if in some time you will decide not- cookie auth, but URL based - the FormsAuthentication will manage it gracefully.