Forms authentication and client caching in ASP.NET 1.1
We got really sad news today, the type of news that makes you have sustained stomachache for a few days.
I'm not going to blog about the way my stomach feels but to remind me that I like what I do and this is not just a job, it's a pleasure.
The Problem:
On one of our web projects that uses Forms authentication.
After the authentication process we create an encrypted ticket,
create the cookie that will be used by the FormsAuthentication
provider and redirect to the requested page:
Dim authTix As New
FormsAuthenticationTicket(1, UserName, DateTime.Now,
DateTime.Now.AddMinutes(60), isCookiePersistent, UserData)
Dim encryptedTix As String =
FormsAuthentication.Encrypt(authTix)
Dim authCookie As New
HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
authCookie.Expires = authTicket.Expiration
Context.Response.Cookies.Add(authCookie)
FormsAuthentication.RedirectFromLoginPage(UserName,
False)
During user log out we clear the session, call the
FormsAuthentication.SignOut() and redirect the user to the login page.
We had, however, an odd behavior. After the user has logged out of the
application, he could, by clicking the back button on the same browser
windows, navigate to the previous pages he opened. These pages were in
the secure area. These pages were not requested to the server, these
requests did not hit the server so I presumed the user was seing cached
pages in the browser.
The Solution:
To use the directive
Context.Response.Cache.SetNoStore()
on all the secure pages that shouldn't be cached.
For more info on the framework class HttpCacheability go to MSDN
For more info on Cache-Control Headers on HTTP 1.1 go here
The Side Effect Problem:
It seems IE does not store the file in its temporary Internet files folder whenever the server specifies the "no-store" http cache directive ; as a consequence, it cannot feed Acrobat/Excel or whatever external application with the output of your page. if the application has excel or pdf reports on the fly, they will generate an error if the http directive is sent in the response.
http://support.microsoft.com/kb/243717/en-us
The Second Solution:
To remove this cache header whenever you need to send to the client a file to be opened in the browser.
I'm not going to blog about the way my stomach feels but to remind me that I like what I do and this is not just a job, it's a pleasure.
The Problem:
On one of our web projects that uses Forms authentication.
After the authentication process we create an encrypted ticket,
create the cookie that will be used by the FormsAuthentication
provider and redirect to the requested page:
Dim authTix As New
FormsAuthenticationTicket(1, UserName, DateTime.Now,
DateTime.Now.AddMinutes(60), isCookiePersistent, UserData)
Dim encryptedTix As String =
FormsAuthentication.Encrypt(authTix)
Dim authCookie As New
HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
authCookie.Expires = authTicket.Expiration
Context.Response.Cookies.Add(authCookie)
FormsAuthentication.RedirectFromLoginPage(UserName,
False)
During user log out we clear the session, call the
FormsAuthentication.SignOut() and redirect the user to the login page.
We had, however, an odd behavior. After the user has logged out of the
application, he could, by clicking the back button on the same browser
windows, navigate to the previous pages he opened. These pages were in
the secure area. These pages were not requested to the server, these
requests did not hit the server so I presumed the user was seing cached
pages in the browser.
The Solution:
To use the directive
Context.Response.Cache.SetNoStore()
on all the secure pages that shouldn't be cached.
For more info on the framework class HttpCacheability go to MSDN
For more info on Cache-Control Headers on HTTP 1.1 go here
The Side Effect Problem:
It seems IE does not store the file in its temporary Internet files folder whenever the server specifies the "no-store" http cache directive ; as a consequence, it cannot feed Acrobat/Excel or whatever external application with the output of your page. if the application has excel or pdf reports on the fly, they will generate an error if the http directive is sent in the response.
http://support.microsoft.com/kb/243717/en-us
The Second Solution:
To remove this cache header whenever you need to send to the client a file to be opened in the browser.
Labels: ASP.NET, Cache, Forms Authentication, HTTP, Security
posted by Lizet Pena de Sola at
10:14 AM
1 Comments:
Programmer Gal..Probably its a little late in the game and you already have a solution but there is a an alternate solution to this.Basically you set the cache to expire. You could use this
Response.Cache.SetCacheability(HttpCacheability.NoCache)
Response.Cache.SetExpires(DateTime.Now - New TimeSpan(1, 0, 0))
Response.Cache.SetLastModified(DateTime.Now)
Response.Cache.SetAllowResponseInBrowserHistory(False)
Post a Comment
<< Home