I have a DotNetNuke website that by default people use anonymously. When they want to login they click a link which takes them to /DesktopModules/AuthenticationServices/ActiveDirectory/WindowsSignin.aspx and then redirects them back to the front page.
On the front page is some jQuery which is designed to change the cookies created during the login process from being permanent to session based (So they’ll disappear when the users browser is closed).
However although I can create and read my own cookies in jQuery (using the cookies plugin) I’m not able to view the cookies that have been created server side during the login.
The image below shows the cookies that exist for the DotNetNuke website.
Demo1 and Demo3 have been created by jQuery with the following code:
$.cookie('Demo1', 'Fred', { expires: 0.005, path: '/' } );
$.cookie('Demo3', 'Peter', { expires: 0.005, path: '/', domain: 'internet.nt.avs' } );
These cookies can then be read using the follow code:
alert( $.cookie('Demo3') );
However if I then try and read one of the other cookies, which I haven’t set through jQuery I get null returned:
alert( $.cookie('.DOTNETNUKE') );
Why is this happening?
Cookies created by ASP.NET through FormsAuthentication have HttpOnly flag set for security reasons. Because of that they can’t be accessed through javascript.