user is authenticated but Ticket.UserData is missing

Question

I have the following code:

if (HttpContext.Current.Request.IsAuthenticated == false)
{
    // this isn't reached so i know user is Authenticated
    return;
}
FormsIdentity fIdentity = HttpContext.Current.User.Identity as FormsIdentity;
string[] delimitedUserData = fIdentity.Ticket.UserData.Split('|');
// but at this point delimitedUserData.Length is 0

Any ideas on what would cause the authentication ticket to be valid yet the UserData is gone?

My program usually works just fine and all the UserData is readily accessible. But every once in awhile I get into this state where the UserData is not there.

Answer 1

The ticket is stored in a cookie. What happens in your code when you access a page just after the cookie has expired?

Also note that User.Identity.IsAuthenticated returns true out of the box, so that property is perhaps not the best thing to test on?

Answer 2

By itself, FormsAuthentication doesn't put anything into your UserData. It'd be worth putting a breakpoint near where you handle ticket creation (and the creation of your UserData) and tracing through the path it takes.

As your bug is intermittent, it'll probably be hard to force it to trigger. A place to start could be tracing through how it handles the cookie expiring, or when a cookie is invalid.

If you're using Firefox, I recommend using the "Add N Edit Cookies" plugin: https://addons.mozilla.org/en-US/firefox/addon/573

Answer 3

Hi

Not sure if this is the best approach as I'm still fairly new to asp.net, but the way that I do this on the login is to set a session value that I can check in later pages - that way, if the cookie is missing, I should not be able to get the value back so I can transfer to the login page.

So, directly after the login (in the _LoggedIn event), I do:

        // write ClientID to the session
        Session.Add("ClientID", lClientID);

then on the load of each page behind the login, I do:

if (User.Identity.IsAuthenticated == false || Convert.ToInt32(Session["ClientID"]) == 0)
    {
        Server.Transfer("Login.aspx");
    }

So far, it's worked pretty well for me.

Answer 4

i am searching for the same issue and find the problem that, i used "FormsAuthentication.RedirectFromLoginPage" to add cookie. i changed into "response.cookies.add". and its working.