PRB: Forms Authentication Requests Are Not Directed to loginUrl Page

• Cookie names
• Cookie paths
• Keys

Identical Cookie Names

Identical Cookie Paths

Identical Keys

<machineKey validationKey="AutoGenerate" decryptionKey="AutoGenerate" validation="SHA1" />
				

Different Cookie Names

1. Application1 uses the name authCookie1.
2. Application2 uses the name authCookie2.
3. A request is made to Application2.
4. Forms authentication tries to retrieve authCookie2 from the HttpRequest.Cookies collection, even though the authCookie1 cookie exists.
   
   When forms authentication does not find an authentication cookie with the name authCookie2, the user is redirected to the page that is specified in the loginUrl attribute for Application2.

Different Cookie Paths

1. Application1 uses the path /application1.
2. Application2 uses the path /application2.
3. Forms authentication authenticates to Application1.
4. A request is made to Application2. The browser does not send the authentication cookie from Application1 to Application2 because the cookie can be sent only to Application1.

Different Keys

<configuration>
   <system.web>
      <authorization>
         <allow users="User1,User2,User3" />
         <deny users="?" />
      </authorization>
   </system.web>
</configuration>
				

<configuration>
   <system.web>
      <authorization>
         <allow users="User4,User5,User6" />
         <deny users="?" />
      </authorization>
   </system.web>
</configuration>
				

Steps to Reproduce Behavior

1. Add the following code as the Web.config file for both applications:

   <?xml version="1.0" encoding="utf-8" ?>
   <configuration>
       
     <system.web>
   
      <authentication mode="Forms">
         <forms loginUrl="login.aspx" name="formsauth1" timeout="60" path="/" >
            <credentials passwordFormat="Clear">
               <user name="username" password="password"/>
            </credentials>
         </forms>
      </authentication>
   
      <authorization>	
        <deny users="?" />
        <allow users="*" />
      </authorization>
      
    </system.web>
   
   </configuration>
   					

2. Add the following code as the Login.aspx file for both applications:

   <%@ Page language="vb" AutoEventWireup="true" %>
   	
       <form  runat=server ID="Form1">    
         <asp:Label runat="server" label="lblUserid" Text="UserID:" />
         <asp:TextBox id="txtUsername" runat=server Text="username" /><br>
         <asp:Label runat="server" label="lblPassword" Text="Password:" />
         <asp:TextBox id="txtPassword" runat=server Text="password" /><br>
         <asp:button text="Login" OnClick="Login_Click" runat=server ID="btnLogin"/><br>
         <asp:Label runat="server" id="lblStatus" />
       </form>
   	 
   <script runat=server>
   sub Login_Click(sender as Object , e as EventArgs )
   	if(FormsAuthentication.Authenticate(txtUsername.Text, txtPassword.Text)) then
   		FormsAuthentication.RedirectFromLoginPage(txtUsername.Text, false)
   	else		
   		lblStatus.Text = "Not Authenticated"
   	end if	
   end sub
   </script> 
   					

3. Add the following code as the Default.aspx file for Application1:

   <%@ Page AutoEventWireup="true" %>
   
   <asp:Label id=label1 runat="server" Text="Authenticated In Application1"></asp:Label><br>
   <asp:Label Runat=server ID="Label2" ></asp:Label>
   </Form>
   					

4. Add the following code as the Default.aspx file for Application2:

   <%@ Page AutoEventWireup="true" %>
   
   <asp:Label id=label1 runat="server" Text="Authenticated In Application2"></asp:Label><br>
   <asp:Label Runat=server ID="Label2" ></asp:Label>
   </Form>
   					

5. Request Default.aspx in Application1.
6. After you are redirected to Login.aspx, log on by typing username for the user name and password for the password. Notice that you are redirected to Default.aspx in Application1.
7. Request Default.aspx in Application2. Notice that you are not redirected to the Login.aspx page in Application2.