Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > Forms Authentication Fails Between ASP.NET 1.0 and 1.1 Applications (Cookie Decryption Fails)

Reply
Thread Tools

Forms Authentication Fails Between ASP.NET 1.0 and 1.1 Applications (Cookie Decryption Fails)

 
 
John Saunders
Guest
Posts: n/a
 
      11-13-2003
I have an existing ASP.NET 1.0 application at the root of a web site. There
is another 1.0 application in a virtual directory under the root. Forms
Authentication works fine between the two.

When the script maps in the sub-application are changed to use ASP.NET 1.1,
Forms Authentication breaks. In particular, the Forms Authentication cookie
no longer decrypts, so that the AuthenticateRequest handler finds
Request.IsAuthenticated == false. No other changes are made to the
sub-application, which was not recompiled for Framework 1.1, and resetting
the script maps to use ASP.NET 1.0 restores full functionality.

Setting both the root application and the sub-application to use ASP.NET 1.1
also allows the cookie to be decrypted properly.

Both applications have an explicit <machineKey> element in their web.config
files.

We are not ready to upgrade all of our applications to use ASP.NET 1.1. Does
anyone have a solution for this, or any ideas of where I should go from
here?

Thanks,
John Saunders




 
Reply With Quote
 
 
 
 
John Saunders
Guest
Posts: n/a
 
      11-18-2003
Wow! No clues anyone? Can anyone else reproduce this?

--
John


"John Saunders" <john.saunders at surfcontrol.com> wrote in message
news:...
> I have an existing ASP.NET 1.0 application at the root of a web site.

There
> is another 1.0 application in a virtual directory under the root. Forms
> Authentication works fine between the two.
>
> When the script maps in the sub-application are changed to use ASP.NET

1.1,
> Forms Authentication breaks. In particular, the Forms Authentication

cookie
> no longer decrypts, so that the AuthenticateRequest handler finds
> Request.IsAuthenticated == false. No other changes are made to the
> sub-application, which was not recompiled for Framework 1.1, and resetting
> the script maps to use ASP.NET 1.0 restores full functionality.
>
> Setting both the root application and the sub-application to use ASP.NET

1.1
> also allows the cookie to be decrypted properly.
>
> Both applications have an explicit <machineKey> element in their

web.config
> files.
>
> We are not ready to upgrade all of our applications to use ASP.NET 1.1.

Does
> anyone have a solution for this, or any ideas of where I should go from
> here?
>
> Thanks,
> John Saunders
>
>
>
>



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Best practices for using forms authentication and security in a hosted env (was: Re: Using a Forms authentication in a shared hosting environment) JEFF ASP .Net 1 11-12-2007 07:00 PM
forms authentication -- expired forms cookie vs. not provided forms cookie Eric ASP .Net Security 2 01-27-2006 10:09 PM
Difference between Python CGI applications and Php applications praba kar Python 2 05-04-2005 06:49 PM
Forms Authentication between web applications on the same server jacob ASP .Net Security 0 04-01-2004 10:23 PM
Forms Authentication question: How to have some pages open and some requiring forms authentication Eric ASP .Net 2 02-13-2004 02:14 PM



Advertisments
 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57