Form Authentication with SSL

[wrytat]

If I use form authentication with SSL with my web application, when I access
my login page, I will go to [url]https://www.mydomainname.com/login.aspx[/url]. After
login, say I redirect the user to afterlogin.aspx. Will my address remain as
[url]https://www.mydomainname.com/afterlogin.aspx?[/url]

Can I explicitly redirect it to [url]http://www.mydomainname.com/afterlogin.aspx?[/url]
Is this a good practice?

This is because my ISP requires me to put every aspx file that requires SSL
encryption in a "/secure" folder, and to access it, users have to go to
[url]https://secure.my-ISP-domain-name.com/my-domain-name/filename.aspx[/url]. So, most
probably, I'll put my login page in that folder, while the other files, I'll
put in other folder since I only need SSL for login. Am I right?

[Brock Allen]

> If I use form authentication with SSL with my web application, when I

> access my login page, I will go to
> [url]https://www.mydomainname.com/login.aspx[/url]. After login, say I redirect
> the user to afterlogin.aspx. Will my address remain as
> [url]https://www.mydomainname.com/afterlogin.aspx?[/url]

Yeah, the RedirectFromLoginPage will keep the https protocol in the address.

> Can I explicitly redirect it to
> [url]http://www.mydomainname.com/afterlogin.aspx?[/url] Is this a good practice?

You can. Instead of FormsAuthenticaytion.RedirectFromLoginPage, just call
FormsAuthentication.SetAuthCookie and then do your own redirect. People do
this all the time to redirect based upon the specific user.

> This is because my ISP requires me to put every aspx file that
> requires SSL encryption in a "/secure" folder, and to access it, users
> have to go to
> [url]https://secure.my-ISP-domain-name.com/my-domain-name/filename.aspx[/url].

Hmm, ok. If they say so :)

> So, most probably, I'll put my login page in that folder, while the
> other files, I'll put in other folder since I only need SSL for login.
> Am I right?

Well, the one thing to keep in mind is that once they've logged in, the cookie
sent back to the browser is what identifies the user. So if the browser is
sending cookies over a non secure channel (http vs https) then if I'm an
attacker and I'm sniffing network packats I could potentially steal the cookie
and then use it was my own. So, if your app is important then I'd make all
pages that require authentication go over https. For other pages they can
go over http but only if the browser doesn't send the cookie and this can
be requested by a web.config setting:

<forms>
requireSSL="true"
</forms>

-Brock
DevelopMentor
[url]http://staff.develop.com/ballen[/url]