Saturday, July 25, 2009

Cookieless ASP.NET forms authentication

Cookieless forms authentication

Why, when?

They say, its not possible. Well it is, and relatively easy to accomplish!

Lot of companies and people want to exclude cookie usage from their lives. Partly because its said to be insecure, partly because they see no reason to use it.

In my case, it was mandatory not to use cookies, but make a forms login page. Of course I've started with the normal forms authentication, cause I believed, that the big brother couldn't make such a mistake, to use cookies.

They did. After searching all the forums how to skip cookie usage, all I've found was this:

The hard way

If you pass the encoded cookie as a GET parameter to the Response.Redirect() function, the system will work as normal: the user will be signed in until the parser can find the cookie as a GET parameter, or a cookie is not easy, and makes no sense at all.

The code snippet to accomplish the "get" way of cookieless authentication is:

See full detail: