ASP.NET Cookieless Forms Auth does not set cookies when the login page is bookmarked

Question

Our ASP.NET 4.0 application form authentication is set to cookieless = "AutoDetect". I noticed that if the user bookmarks the login page, the bookmark link will be https://hostname.com/Login.aspx?AspxAutoDetectCookieSupport=1 . If the user navigates to this directly from a new browser session and performs a valid login, the cookie is not set. If I go directly to this page, bu will remove AspxAutoDetectCookieSupport from the query string, the cookie will be created correctly.

If the user goes directly to Default.aspx or the root directory, the login works correctly even if AspxAutoDetectCookieSupport = 1 is bound to the query string.

When the user clicks the login button, we do a postback to the login page and manually check the user credentials against our database. If successful, we do:

FormsAuthentication.RedirectFromLoginPage(userName, false); 

I spent many hours debugging, including looking at the ASP.NET forms authentication code in the original source, and was unable to determine what caused this. The only solution we have at the moment is to get users to remove the login page from the bookmark URL and add a bookmark button on our user login page.

Is there any other solution to fix this forms authentication problem? Is this authentication on the form?

Answer 1

The problem is that you always use RedirectFromLoginPage, regardless of whether the redirect location is provided. If it is not specified, the redirect will fail. The correct solution for this would be to check the redirect URL and redirect to default.aspx if it is not available (the original example is borrowed from this blog article ):

 // Once the user entered credentials are verified // if(Request.Params["ReturnUrl"] != null) { FormsAuthentication.RedirectFromLoginPage(txtUserName.text, false); } else { FormsAuthentication.SetAuthcookie(txtUserName.text, false); Response.Redirect("Default.aspx"); }