Validate users

[angst11]

Any suggestions on a good way to validate users as they move from page to page? I initially use forms authentication but they can actually move to other sites.


Thanks in advance!

 

[dace]

Forms authentication will still work in this case - it's based on a cookie that gets stored on the user's computer, so it doesn't matter if they visit another site in the meantime. They will still be authenticated as long as their session (set by the Timeout value in web.config) hasn't expired.

 

[angst11]

What if the individual bookmarked the link and tried to return? I assume it would also be an issue if another site was asp.

 

[dace]

-No, other sites won't cause issues, regardless of what they are.

-If the individual bookmarked the site and tried to return, as long as they were within their session timeout they'd get right back in. You can set the auth cookie to not expire, and can use persistent sessions to keep them logged in indefinitely on the server.

That said, IMO it's a bad idea to have infinitely-persistent sessions: they take up extra storage, and are a security issue.

 

[angst11]

So once someone is redirected to another site, I just need to check the cookie?