Security of Forms Authentication in the ASP.NET virtual host

xiaoxiao2021-03-05  27

Original by fancyf (fancyray) http://blog.9cbs.net/fancyf/ After the "ASP.NET Forms Authentication" is finished, "I feel that it can be empty for Forms, and the result is initially issued. The owner mentioned a question: How is MachineKey implemented? Is the MachineKey used by different web applications on the same virtual host? I didn't expect this question last time, and I did a try. Test Idea: Newly built a WebApplication on the same computer, the domain name bound is not the same, nor is it in the same application pool. Generate a cookie in the new WebApplication to see if the value is verified in the original WebApplication. Test Process: In order to bind different domain names, the DNS service is launched on this computer and point the DNS server in the network connection to the IP of this computer. The constructor FormsAuthenticationTicket prototype: method call public FormsAuthenticationTicket (int version, string name, DateTime issueDate, DateTime expiration, bool isPersistent, string userData, string cookiePath) and in GetAuthCookie (...) in: FormsAuthenticationTicket ticket1 = new FormsAuthenticationTicket ( ? 1, userName, DateTime.Now, createPersistentCookie DateTime.Now.AddYears (50): DateTime.Now.AddMinutes ((double) FormsAuthentication._Timeout), createPersistentCookie, "", strCookiePath); two decided to put text on the test page box, a user name txtUsername2, a time txtGenDate (instead of DateTime.Now), then write in the button's Click event Generation: DateTime genDate = DateTime.Parse (this.txtGenDate.Text); FormsAuthenticationTicket ticket1 = new FormsAuthenticationTicket ( 1. THIS.TXTUSERNAME2.TEXT, GENDATE, GENDATE.ADDYEARS (50), true, "", "/") ;THIS.LBLENCRYPTEDCOOKIE.TEXT = Formsauthentication.encrypt (Ticket1); Running Discovery, the same username and generating time The results obtained by FormSauthentication.encrypt (Ticket1) are different each time, but each result is valid.

Now this page to get WebApplication newly created run, the result of a group placed on the original WebApplication Login.aspx page: