ASP.NET MVC RememberMe

Question

After searching a lot i did not get any answers and finally i had to get back to you. Below i am explaining my problem in detail. It's too long, so please don't quit reading. I have explained my problem in simple language.

I have been developing an asp.net mvc project. I am using standard ASP.NET roles and membership. Everything is working fine but the remember me functionality doesn't work at all. I am listing all the details of work. Hope you guys can help me out solve this problem.

I simply need this:

I need user to login to web application. During login they can either login with remember me or without it. If user logs in with remember me, i want browser to remember them for long time, let's say atleast one year or considerably long time. The way they do it in www.dotnetspider.com,www.codeproject.com,www.daniweb.com and many other sites. If user logs in without remember me, then browser should allow access to website for some 20 -30 minutes and after that their session should expire. Their session should also expire when user logs in and shuts down the browser without logging out.

Note: I have succesfully implemented above functionality without using standard asp.net roles and membership by creating my own talbes for user and authenticating against my database table, setting cookie and sessions in my other projects. But for this project we starting from the beginning used standard asp.net roles and membership. We thought it will work and after everything was build at the time of testing it just didn't work. and now we cannot replace the existing functionality with standard asp.net roles and membership with my own custom user tables and all the stuff, you understand what i am taling about.

Either there is some kind of bug with standard asp.net roles and membership functionality or i have the whole concept of standard asp.net roles and membership wrong. i have stated what i want above. I think it's very simple and reasonable.

What i did

1. Login form with username,password and remember me field.

2. My setting in web.config:
   
   <authentication mode="Forms">
   <forms loginUrl="~/Account/LogOn" timeout="2880"/>
   </authentication>
   
   

3. in My controller action, i have this:

   FormsAuth.SignIn(userName, rememberMe);

   public void SignIn(string userName, bool createPersistentCookie) { FormsAuthentication.SetAuthCookie(userName, createPersistentCookie); }

Now the problems are following:

I have already stated in above section "I simply need this". user can successfully log in to the system. Their session exists for as much minutes as specified in timeout value in web.config. I have also given a sample of my web.config. In my samplem if i set the timeout to 5 minutes,then user session expires after 5 minutes, that's ok. But if user closes the browser and reopen the browser, user can still enter the website without loggin in untill time specified in "timeout" has not passed out. The sliding expiration for timeout value is also working fine. Now if user logs in to the system with remember me checked, user session still expires after 5 minutes. This is not good behaviour, is it?. I mean to say that if user logs in to the system with remember me checked he should be remembered for a long time untill he doesn't logs out of the system or user doesn't manually deletes all the cookies from the browser. If user logs in to the system without remember me checked his session should expire after the timeout period values specified in web.config and also if users closes the browser. The problem is that if user closes the browser and reopens it he can still enter the website without logging in.

I search internet a lot on this topic, but i could not get the solution. In the blog post(http://weblogs.asp.net/scottgu/archive/2005/11/08/430011.aspx) made by Scott Gu on exactly the same topic. The users are complaining about the same thing in their comments ut there is no easy solution given in by Mr. Scott.

I read it at following places: http://weblogs.asp.net/scottgu/archive/2005/11/08/430011.aspx Link

I guess this is a problem of lot's of users. As seem from blog post made by Mr. Scott Gu.

Your help will be really appreciated. Thanks in advance.

Ubangi

You're right. Your question is too long. You should make it shorter. – Tails

BTW, It's Mr. Scott Guthrie aka The Gu. – Tails

Wasn't that long at all. Didn't need to jump through loops to understand question. :) – Brothel

Answer 1

What you want to do is have a different timeout when the RememberMe option is checked, than when it is unchecked. Unfortunately, the SetAuthCookie method does not allow you to set the expiration manually, so you'll have to do that yourself.

The problem is then, how to do that?

ASP.NET MVC uses the FormsAuthentication class of System.Web.Security to do that, because it's not trivial if you also want to support the configuration settings and cookieless browsing and SSL, but I think that if you simply do this:

int timeout = rememberMe ? 525600 : 30; // Timeout in minutes, 525600 = 365 days.
var ticket = new FormsAuthenticationTicket(userName, rememberMe, timeout);
string encrypted = FormsAuthentication.Encrypt(ticket);
var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted);
cookie.Expires = System.DateTime.Now.AddMinutes(timeout);// Not my line
cookie.HttpOnly = true; // cookie not available in javascript.
Response.Cookies.Add(cookie);

...you'll get a basic version of what you need.

NOTE: I did not test this code.

Tails

Dave, your solution worked for me. But doing only this is not sufficient. I had to add a line of code to make it remember for at least an year. I have written below. – Ubangi

if anyone finds this isn't working make sure the process isn't using the login-control's redirect URL, you can just add Response.Redirect("./"); to the end of the method to prevent the default behavior (which was overwriting the timeout with the one in the web.config) – Pistareen

Answer 2

Kevin and Dave,you guys rock, man.

Dave, in addition to your code i had to add one more line to make it work. I mean to make it remember for at least one year. I had to assign value to cookie.Expires in addition to your code to make it work. If this line cookie.Expires is not set the cookie is lost after computer restart i mean at the end of the session. I noticed this in FireFox. I Went through the details of cookie and i found: If cookie.Expires is not set then value for "Expires:" attribute in Firefox is "At the end of the session" but if cookie.Expires is set then the value for "Expires:" attribute in Firefox is to the datetime the cookie.Expires value was set.

Here is the code:

int timeout = createPersistentCookie ? 525600 : 2; // Timeout in minutes,525600 = 365 days
var ticket = new FormsAuthenticationTicket(userName,createPersistentCookie,timeout);            
string encrypted = FormsAuthentication.Encrypt(ticket);
var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted);
cookie.Expires = System.DateTime.Now.AddMinutes(timeout);//My Line
HttpContext.Current.Response.Cookies.Add(cookie);

Thank you guys, that was really a great solution.

Ubangi

Answer 3

Just a quick note about using membership auth ticket in a shared environment for anyone who may land here with that issue. I've got an mvc site runnig at godaddy and had trouble with remember me. This was the solution:

<system.web>
<machineKey
  validationKey="4C6404A3B305CD6E8CFEAC258F042FB95E45E9C3C2CEC3AAB838996CFBE661E41DF1A1BAC75B9B45E02147612FD9B71CA74DDA50B0D0D6ED11F0BB8E31048953"
  decryptionKey="BC471CF17A97B08A9DF85C7B502AD95680E3BE4418FD9C6CEA57E7F97ED64291"
  validation="SHA1" decryption="AES"
/>

Thanks to : http://www.geekfreeq.com/aspnet-remember-me-option-forms-authentication-not-working/

Chancey

That link is back up now apparently. – Eun

You can create these setting here as well aspnetresources.com/tools/machineKey – Octosyllable

Answer 4

That's not a problem, it's a feature :)

The user's session hasn't expired yet so, even if they close and reopen the browser, the cookie is still good.

It's the cookie's expiration that invalidates the user's session.

Holbrooke

thanks kervin, you are correct. This cleared one of my doubts. – Ubangi

Answer 5

I had implemented same thing and when i test it it works fine in Mozila but not working in IE8 for all pc, i also had updated setting to accept cookies in IE but still not working.

Internet Explorer 8.x

1. Click on the Tools-menu.
2. Select Internet Options in the menu - a new window opens.
3. Click on the Privacy tab near the top of the window.
4. Click on the Default button of the window.
5. Move the slider so that it is on one of the levels below Medium High (including Medium, Low, Accept All Cookies).
6. Save changes by clicking OK.
7. You should be able to add items to your shopping cart now.

Lula