Best way to manage Session state and Authentication

Question

Best way to manage Session state and Authentication

xprogrammerx 20

Greetings everyone,

I'm developing an ASP.NET MVC App with Forms authenticatioin and the Membership (API) (i can't use Identity for now).

I noticed that the Session state is not always in sync with the authentication session , meaning, that a user can have an expired session and still be logged in, which will result in exception when trying to retrieve his authentication informations from the session.

Here is what i observed :

-Session is mapped to the server by an identifier set in a cookie .

-if the sessionState timeout expires than the session expires

-If we close the browser (all the browser tabs) than the cookie is deleted , and still the session lives on the server ,but because it can't be mapped to the session by the cookie , it creates a new session thus reinitializing it.

-if we stop the app on the server or the server recycles the session is lost

-The authentication identifier is also stored in a cookie.

-If the forms timeout expires than the user will be logged off.

-The authentication cookie is also removed when the browser is closed (all the browser tabs) therefore user is logged out ,Unless FormsAuthentication.createPersistentCookie is true than the user is still logged in even if he closes the browser.

-However if the user does not close the browser and the app in the server is stopped or the server recycles , than the user is still kept logged in, because the authentication cookie is still in the browser, and yet the session is lost.

I was wandering what is the best way to manage session state with forms authentication , i read that the session should not be synchronized with the authentication

process because they are not the same thing.

I was thinking to fix the issue in bold above, i would implement Session_Start in globall.asax to retrieve informations about the user if he is authenticated each time the session starts.

Thank you.

Accepted answer

1 additional answer

Your answer

Answer 1

SurferOnWww 4,721

I was wandering what is the best way to manage session state with forms authentication , i read that the session should not be synchronized with the authentication

The Session State and Forms Authentication of the ASP.NET are independent. There is no relation between them at all. Therefore, you may forget about the Session State when you consider the Forms Authentication.

xprogrammerx 20 Reputation points

2023-10-10T00:41:27.0966667+00:00

I agree with you, although as i'm not implementing Identity i find nowhere to persist user info but in the session state , i don't want to use cookies.....
SurferOnWww 4,721 Reputation points

2023-10-10T01:05:30.5033333+00:00

but in the session state , i don't want to use cookies.....

It seems to me that the above is contradicting. The Session State uses a cookie to identify the user.
QiYou-MSFT 4,326 Reputation points Microsoft External Staff

2023-10-10T08:16:59.62+00:00

Hi @xprogrammerx

Form validation is related to cookies, it is not directly related to sessions.

Best Regards

Qi You
xprogrammerx 20 Reputation points

2023-10-10T12:26:38.2333333+00:00

Ok than , so the best way to store temporary user information with forms authentication is to use cookies.

Of course we may have other lenghty informations which only can be stored in the session(we don't want to use the database) , so we'll just make them unrelated to the authentication process.

Sometimes i also use Windows authentication , and Forms authentication with Active Directory Provider.

Best Regards.
SurferOnWww 4,721 Reputation points

2023-10-10T12:49:19.4833333+00:00

so the best way to store user information with forms authentication is to use cookies.

No, it is not the way that ASP.NET Forms Authentication system provides.

In the ASP.NET Forms Authentication system, the critical user information such as the user id and password is stored at the server side such in the SQL Server database.

The cookie stores the authentication ticket. Please note that the authentication ticket does not include critical user information such as the user id and password.
xprogrammerx 20 Reputation points

2023-10-10T14:13:37.0733333+00:00

Ok than , so the best way to store temporary user information with forms authentication is to use cookies.

What i meant was temporary user informations, of course the persistent informations would be in the database, but when the user get logged in you would need some temporary informations to be accessible so that you don't contact the database evrytime.
AgaveJoe 30,126 Reputation points

2023-10-10T14:38:24.33+00:00

The Forms Authentication token has a user data area where you can store whatever you like inside the auth cookie along with the user's identity.

If you want to store user information in session, then write code that refreshes Session when session is null. Keep in mind, checking any cache for null and reloading is a standard programming pattern because a cache like session is volatile.

I would craft a separate static class that populates Session using the user's identity from forms authentication. That way you are only going to the database when Session is empty.
SurferOnWww 4,721 Reputation points

2023-10-10T14:40:20.5833333+00:00

You did not say "temporary" in your previous comment.

Anyway, there is a provision in the ASP.NET Forms Authentication system to identify an anonymous user by using a cookie. I guess that you will need to study and obtain more detailed knowledge regarding how the ASP.NET Forms Authentication system works.
xprogrammerx 20 Reputation points

2023-10-10T15:26:41.4533333+00:00

The Forms Authentication token has a user data area where you can store whatever you like inside the auth cookie along with the user's identity.

That is good news , can you provide me an example how to use this user data area?

If you want to store user information in session, then write code that refreshes Session when session is null. Keep in mind, checking any cache for null and reloading is a standard programming pattern because a cache like session is volatile.

That is what i had in mind, i can even use the Session_Start event in global.asax to intilalize the session according to the user authentified.

You did not say "temporary" in your previous comment.

Yes i edited my comment to reflect what i had in mind, and also to reflect the right informations.
AgaveJoe 30,126 Reputation points

2023-10-10T17:43:34.7766667+00:00

can you provide me an example how to use this user data area?

Understanding the Forms Authentication Ticket and Cookie

FormsAuthenticationTicket Class

FormsAuthenticationTicket.UserData Property

UserDate is a string. You get to create whatever string format you like. For edxample, JSON, CSV, ...
xprogrammerx 20 Reputation points

2023-10-10T18:48:05.1966667+00:00

Ok so about the FormsAuthenticationTicket it is settled

But how about if i want to store info in the session, is it convenient to implement Session_Start in global.asax to reinitialize the session according to the user authentified or is it unconvenient?
AgaveJoe 30,126 Reputation points

2023-10-10T19:31:53.5733333+00:00

But how about if i want to store info in the session, is it convenient to implement Session_Start in global.asax to reinitialize the session according to the user authentified or is it unconvenient?

I explained how I would do deal with cache. At the point where the data is needed I would check if the Session has the data. If the Session has the data then get the data from Session. If the Session does not have the data then load the data. I would write a basic C# class to handle the details.

If you want to use Session_Start then give it a try.
xprogrammerx 20 Reputation points

2023-10-10T19:46:23.2733333+00:00

Ok i will give it a try, thank you.

Answer 2

Bruce (SqlWork.com) 78,086 Volunteer Moderator

Both session and authentication use cookies, and the default is browser session only (not stored) and similar timeout. But as stated above, they are independent of each other. You can have have a 90 day persistent session cookie, and 20 minute identity cookie or the reverse.

xprogrammerx 20 Reputation points

2023-10-10T15:32:07.95+00:00

Yes both session and authentication use cookies,

-Session is mapped to the server by an identifier set in a cookie .
Bruce (SqlWork.com) 78,086 Reputation points Volunteer Moderator

2023-10-10T18:08:33.97+00:00

if you don't want session lost on recycle, use a persistent session. I have done apps where session is good for months and works whether the user is logged in or not.

note: I've never used in-proc session with production apps which typically are a farm.

Share via

Best way to manage Session state and Authentication

1 additional answer

Your answer