1

I have this issue where a cookie never gets set because I believe it's using the wrong one. This is happening on play.exposureevents.store. I have no idea how, but a exposureevents.com cookies is available on this domain somehow. I believe when trying to authenticate it is using the .exposureevents.com cookie and never setting the correct cookie. Is there a way in ASP.NET to either remove the wrong cookie, or set the correct one?

Create Cookie On Login

public SiteMemberModel CreateAuthenticationCookie(string username, Guid userId, string roles)
{
    var member = GetMemberProfile(userId, username);

    var ticket = new FormsAuthenticationTicket(
        2,
        username,
        DateTime.Now,
        DateTime.Now.AddMinutes(FormsAuthentication.Timeout.TotalMinutes),
        false,
        JsonConvert.SerializeObject(member, Formatting.None),
        FormsAuthentication.FormsCookiePath);

    var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(ticket))
    {
        Secure = true,
        Path = FormsAuthentication.FormsCookiePath,
        SameSite = SameSiteMode.None
    };

    if (!HttpContext.Current.Request.IsLocal)
    {
        cookie.Domain = Helper.GetDomain();
    }

    if (ticket.IsPersistent)
        cookie.Expires = ticket.Expiration;

    HttpContext.Current.Response.Cookies.Add(cookie);

    return member;
}

Web.config

<httpCookies requireSSL="true" sameSite="None" />
<authentication mode="Forms">
  <forms loginUrl="/login" path="/" cookieSameSite="None" requireSSL="true" protection="All" timeout="2880" slidingExpiration="true" name="_EXPOSURE_" />
</authentication>

enter image description here

Mike Flynn
  • 22,342
  • 54
  • 182
  • 341
  • See a detailed breakdown of how web cookies work here: https://stackoverflow.com/questions/18492576/share-cookies-between-subdomain-and-domain – Spikeh Apr 26 '23 at 13:13

0 Answers0