Asp.Net Forms Authentication when using iPhone UIWebView

Question

I am writing a Asp.net MVC 2 application that uses Forms Authentication and currently I am having a problem with our iPhone application in regards to the authentication/login over the web. We have developed a simple iPhone app that uses the the UIWebView control. At this stage, all the app does is navigate to our Asp.Net website. Simple, right? The problem is, that the user cannot get past the login page. The repro steps are:

• Open iPhone app.
• The app navigates to the home page.
• the user is not authenticated, so they are redirected to the login screen/page
• The user enters the correct user name and password. clicks submit.
• on the server side, the user is authenticated and a cookie is generated and sent to the client using FormsAuthentication.GetAuthCookie.
• The server sends are redirect to send the user to the correct home page.

But the user is then redirected BACK to the login screen!

I've done some extensive debugging on this and what I do know is:

The cookie is being sent to the client, and the client is storing the cookie. Verified this in the iPhone debugger and also by using Javsascript to display cookie data on the page. The cookie is being sent back to the server. Verified this in the Visual Studio debugger. It is the correct cookie (it's the same one that was set). The property User.Identity.IsAuthenticated returns false for some reason, even though the auth cookie is contained in the Request object. I have verified that the iPhone app is setup to accept cookies, and they are on the client.

Here is the funny thing: It works fine if you open the Safari browser on the iPhone and go to our site directly.

It has the same behaviour on the iPad too in that it doesn't get past the login screen. This repros on the emulators, and on devices.

This same web site has been tested with IE 7-8, Safari (for Windows), Blackberry, IEMobile 6.5, Phone 7 and it works find. The only circumstance that it doesn't work on is the UIWebView in the iPhone app.

Answer 1

I had exactly the same problem, but with another device (NokiaN8), and also traced the problem back to the User-Agent.

IIS uses regular expressions to match against the User-Agent string. The root of the problem was that it didn't have any matching regular expressions for the specific device, and ended up in one of the lowest levels of match, where the Default properties were used. The default properties said that the browser didn't support cookies.

Solution:

1. Add a folder in your web project named App_Browsers (right-click the project, choose: Add > Add ASP.NET Folder > App_Browsers).
2. Add a file in that folder (right-click, choose: Add > New Item). The file can have any name, but must have the .browser ending.
3. Add a good matching expression and the correct capabilities (or add changes to the Default).

Two examples:

<browsers>   <browser id="NokiaN8" parentID="Mozilla">     <identification>       <userAgent match="NokiaN8" />     </identification>     <capabilities>       <capability name="browser" value="NokiaN8" />       <capability name="cookies" value="true" />      </capabilities>    </browser>  </browsers> 

Or change the default:

<browsers>   <browser refID="Default">      <capabilities>        <capability name="cookies" value="true" />      </capabilities>   </browser> </browsers> 

More info: Browser Definition File Schema

Answer 2

The solution we found was to create a file (generic.browser) and include this xml to tell the web server that "Mozilla" and the Default browser settings should all support cookies.

<browser refID="Mozilla" >     <capabilities>         <capability name="cookies"  value="true" />     </capabilities> </browser>