Hi guys,
I implement form authentication mechanism on my site, so I renew session id (by abandoning session state obj & cleaning session cookie),
when user enters login page. Well... actually, aside other things, I renew session id if user "is not authenticated".
How can I check that user is authenticated? I can use HttpRequest.IsAuthenticated , which will check authentication cookie.
So there are questions pop up.
1. I dont know exactly when HttpRequest.IsAuthenticated gets "true". It looks like it sets to true, when server gets authentication cookie from browser. I am talking about only form authentication and UseCookies mode.
2. Anyway, I can check cookie collection and gets authentication cookie from it. Suppose I get it. Do I need to decrypt and check the ticket values to compare session ids in code, to make sure that I have the right ticket 0_o ? do I need then store session id inside authe ...
Go to the complete details ...