ReturnUrl=%2f Issue in ASP.NET Forms Authentication

Some time back I used FormsAuthentication in an ASP.NET  project and everything seemed to be working fine expect for a one issue.

When I Loged into the application and clicked on LogOut it was navigating to the LogIn page and it adds 'ReturnUrl=%2f' to the Return URL and it caused me to click on the LogIn button twice with correct authentication details, in order to navigate to the default page. I added the below code snippet and it solved the issue for me.

In Global.asax.cs file.

    void Application_BeginRequest(object sender, EventArgs e)
    {
        if (Request.AppRelativeCurrentExecutionFilePath == "~/")
            HttpContext.Current.RewritePath("~/Gate/Index.aspx");//This is the default page to navigate after a successful login.
    }

How to Pass Custom Data in FormsAuthenticationTicket

Lets say we have an custom object with following properties.

public class AuthUser
{
public int UserID { get; set; }
public string UserNo { get; set; }
public string UserName { get; set; }
public string Password { get; set; }


public override string ToString()
{
return UserID + "," + UserNo + "," + UserName + "," + Password; 
}


}

To pass custom data with the authentication ticket use below code.

AuthUser au = new AuthUser();
au.UserID = 1;
au.UserNo ="001";
au.UserName = "chamara";
au.Password = "123";
string userData = au.ToString();

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(

             2,                             // Version number

             txtUserName.Text.Trim(),      // Username

             DateTime.Now,                  // Issue date

             DateTime.Now.AddDays(555), // Expiration date

             false,                         // Persistent?

             userData                 // User data

);

Retrieve Userdata

FormsIdentity id = (FormsIdentity)Context.User.Identity;
FormsAuthenticationTicket ticket = id.Ticket;
string[] UserData = ticket.UserData.Split(',');

ASP.NET Security: Secure Sockets Layer (SSL)

SSL technology encrypts communication between a client and a website. Although it slows performance, it’s often used when private or sensitive information needs to be transmitted between an authenticated user and a web application. Without SSL, any information that’s sent over the Internet, including passwords, credit card numbers, and employee lists, is easily viewable to an eavesdropper with the right network equipment.

Even with the best encryption, you have another problem to wrestle with—just how can a client be sure a web server is who it claims to be? For example, consider a clever attacker who uses some sort of IP spoofing to masquerade as Amazon.com. Even if you use SSL to transfer your credit card information, the malicious web server on the other end will still be able to decrypt all your information seamlessly. To prevent this type of deception, SSL uses certificates.

The certificate establishes the identity, and SSL protects the communication. If a malicious user abuses a certificate, the certificate authority can revoke it. To use SSL, you need to install a valid certificate. You can then set IIS directory settings specifying that individual folders require an SSL connection. To access this page over SSL, the client simply types the URL with a preceding https instead of http at the beginning of the request.

In your ASP.NET code, you can check whether a user is connecting over a secure connection using code like this:

protected void Page_Load(Object sender, EventArgs e)

{

 if (Request.IsSecureConnection)

{

lblStatus.Text = "This page is running under SSL.";

}

else

{

lblStatus.Text = "This page isn't secure.<br />";

lblStatus.Text += "Please request it with the ";

lblStatus.Text += "prefix https:// instead of http://";

}

}

ASP.NET Security: Retrieving the User’s Identity

Once the user is logged in, you can retrieve the identity through the built-in User property, as shown here:

protected void Page_Load(Object sender, EventArgs e)

{

lblMessage.Text = "You have reached the secured page, ";

lblMessage.Text += User.Identity.Name + ".";

}

You don’t need to place the code in the login page. Instead, you can use the User object to examine the current user’s identity anytime you need to.

You can access the User object in your code because it’s a property of the current Page object. The User object provides information about the currently logged-in user. It’s fairly simple—in fact, User provides only one property and one method:

• The Identity property lets you retrieve the name of the logged-in user and the type of authentication that was used.

• The IsInRole() method lets you determine whether a user is a member of a given role (and thus should be given certain privileges).

ASP.NET Security: Members of the FormsAuthentication Class

FormsCookieName 

A read-only property that provides the name of the forms authentication cookie.

FormsCookiePath 

A read-only property that provides the path set for the forms authentication cookie.

Authenticate() 

Checks a user name and password against a list of accounts that can be entered in the web.config file.

RedirectFromLoginPage() 

Logs the user into an ASP.NET application by creating the cookie, attaching it to the current response, and redirecting the user to the page originally requested.

SignOut() 

Logs the user out of the ASP.NET application by removing the current encrypted cookie.

SetAuthCookie() 

Logs the user into an ASP.NET application by creating and attaching the forms authentication cookie. Unlike the RedirectFromLoginPage() method, it doesn’t forward the user back to the initially requested page.

GetRedirectUrl() 

Provides the URL of the originally requested page. You could use this with SetAuthCookie() to log a user into an application and make a decision in your code whether to redirect to the requested page or use a more suitable default page.

GetAuthCookie() 

Creates the authentication cookie but doesn’t attach it to the current response. You can perform additional cookie customization and then add it manually to the response.

HashPasswordForStoringInConfigFile() 

Encrypts a string of text using the specified algorithm (SHA1 or MD5). This hashed value provides a secure way to store an encrypted password in a file or database.

ASP.NET Security: Controlling Access to Specific Files

Generally, setting file access permissions by directory is the cleanest and easiest approach. However, you also have the option of restricting specific files by adding <location> tags to your web.config file.

The location tags sit outside the main <system.web> tag and are nested directly in the base <configuration> tag, as shown here:

<configuration>

<system.web>

...

<authentication mode="Forms">

<forms loginUrl="~/Login.aspx" />

</authentication>

<authorization>

<allow users="*" />

</authorization>

</system.web>

...

<location path="SecuredPage.aspx">

<system.web>

<authorization>

<deny users="?" />

</authorization>

</system.web>

</location>

<location path="AnotherSecuredPage.aspx">

<system.web>

<authorization>

<deny users="?" />

</authorization>

</system.web>

</location>

</configuration>

In this example, all files in the application are allowed, except SecuredPage.aspx and AnotherSecuredPage.aspx, which have an additional access rule denying anonymous users.

Notice that even when you use multiple <location> sections to supply different sets of authorization rules, you still only include one <authentication> section. That’s because a web application can use only one type of authentication.