Question

I have a small conundrum where I have an asp.net application that’s using forms based authentication. Inside of the application, I have a webservice that checks User.IsInRole(“somerole”) which works fine with ajax calls from the application since the user is logged in, and the ajax calls come from his logged in browser.

Now, I want to make a fat client call the webservices (c# console client for starters), but cant figure out how to pass the credential information to it.

I’ve looked at doing something like the following to no avail:

SomeWebService svc = new SomeWebService();
svc.Credentials = new NetworkCredential("formsusername","formspassword","");
String returnValue = svc.CallMyWebMethod();

Can anyone out there show me the trick to this? 🙂

Thanks!

Answer 1

Forms Authentication works by having the client send a Cookie along each request. This cookie is emitted by the server when the client successfully authenticates by sending the correct credentials.

So here are the steps that you need to do in your console application in order to authenticate the user using forms authentication:

1. Send an HTTP POST request to some web page passing the username and password. In response the web server will give you the authentication cookie (Set-Cookie HTTP response header) that you need to capture. That’s usually your Log page.

2. When calling your web service you need to pass this cookie (Cookie HTTP request header). In order to set a cookie along with the request, you will have to override the GetWebRequest method on the client proxy class that was generated for you:

   protected override WebRequest GetWebRequest(Uri uri)
   {
       var request = (HttpWebRequest)base.GetWebRequest(uri);
   
       request.CookieContainer.Add(
           new Cookie(
               ".ASPXAUTH", 
               "THE VALUE YOU HAVE RETRIEVED WHEN YOU SEND YOUR FIRST LOGON REQUEST"
           )
       );
   
       return request;
   }