Question

I use the forms authentication in my asp.net application and I protect all the pages using:

deny user=*

And when a user logs in, I use:

FormsAuthentication.RedirectFromLoginPage(UserName.Text, false);

Now if I use IE6 when I open a window and login it works, but then if I open a new window ,I have to login again. It seems that a new IE6 window will open a new session or cookie (I am not sure) – how can I avoid this?

Answer 1

There are multiple approaches. I believe the impact for the user should be as little as possible.

• You could store the last logged in, or last database action timestamp in your database. Doing so, you can verify if the last action the user had was within a number of minutes. Additionally, you could store the username ( not password ) in a cookie on the client. Next time the client opens a new session, you know the username, verify on database that the last database activity was within a number of minutes, and bypass the login obligation.

• Second approach involves changing startup parameters of the clients browser, so that new windows share the session. I do not know whether this is available on all browers ( and versions ) and if you are capable of doing this.

• redesign your web application so new windows don’t need to be opened, unless they are from within the opened window. If they are opened from an existing, logged in window, you can send a hash key in query string, which bypasses the login procedure.

These are just a few possibilities which come to mind at this point.. If you should require more possibilities, just ask 🙂