At first, you should modify and check authentication mode of Web.config. It will play an important role around whole processes.
<authentication mode="Forms">
<forms loginUrl="Default.aspx"
protection="All"
requireSSL="false"
timeout="60"
name=".SSOAUTH"
path="/"
cookieless="UseCookies"
slidingExpiration="true" />
</authentication>
You should notice the parameters path="/" and
cookieless="UseCookies". You have to confie your limitation of cookie
using path and you'd better explicitly define "UseCookie" unless you
will get an endless transfer pages[1].
2. Issue Cookie
Once, login was successfule, you have to make IIS responses the login information to the client using cookie.
protected void Login1_LoggedIn(object sender, EventArgs e)
{
if (Response.Cookies.Count > 0)
{
foreach (string s in Response.Cookies.AllKeys)
{
if (s == FormsAuthentication.FormsCookieName)
{
if (Login1.RememberMeSet == true)
{
// change the value to increase the cookies expiration by
Response.Cookies[s].Expires = DateTime.Now.AddDays(1);
}
}
}
}
}
3. Execute Auto-login Using Cookie
ASP.NET has a reserved name for login cookie as like "__LOGINCOOKIE__".
In this step, determine the validation of cookie and user information
from the __LOGINCOOKIE__ as follows:
Add cookie handling source in the login page[5].
protected void Page_Load(object sender, EventArgs e)
{
if (!Page.IsPostBack)
{
try
{
// get login cookie and decrypt it.
FormsAuthenticationTicket ticket =
FormsAuthentication.Decrypt(Request.Cookies["__LOGINCOOKIE__"].Value);
FormsIdentity id = new FormsIdentity(ticket);
// extract user information.
Context.User = new System.Security.Principal.GenericPrincipal(id, new string[0]);
string user = Context.User.Identity.Name.ToString();
// check validation.
if (user != null && user.Length > 0 && ticket.Expired != true && ticket != null)
{
Response.Redirect("main.aspx"); // redirect to the main page.
}
}
catch
{
// Decrypt method failed.
}
}
}
If your cookie was normal as accurate, you can see the main.aspx page without login process.