Where is .ASPXAUTH cookie

Question

In javascript alert(document.cookie); does not show the .ASPXAUTH Cookie although a sniffer is showing it,

I need it because I have an AJAX Request to the server, the request should not take place when the user is already logged in,

if I cannot check .ASPXAUTH for security reason, what I should do to check whether the user is already logged in.

Thanks

Answer 1

The authentication cookie is marked with http-only, meaning it cannot be accessed by javascript. If you want to check is the user is authenticated, simply output a javascript variable, an hidden field or whatever you prefer from your code-behind. You can then check this easily in JS.

Answer 2

There is a .ASPXAUTH cookie set, you are obviously correct. It is used to determine if a user if logged in.

To get what you need look over your web.config for the config section:

<authentication mode="Forms">
      <forms
                loginUrl="~/login.aspx"
                protection="All"
                timeout="30"
                name="ExampleSite.FormsAuthentication"
                path="/"
                requireSSL="false"
                slidingExpiration="true"
                defaultUrl="index.aspx"
                cookieless="UseDeviceProfile"
                enableCrossAppRedirects="false"
                />
    </authentication>

When the user is successfully authenticated a cookie will be set based off the name="ExampleSite.FormsAuthentication" parameter. It will expire after logging out or after the session expires. You will see a cookie on Chrome/FFX or whatever browser you are using called ExampleSite.FormsAuthentication with an encrypted value. Obviously the name parameter you are using will be different and not ExampleSite.FormsAuthentication but you get the idea.

You could always check and see if the cookie exists. As mentioned be careful of the http-only (with relation to JS). As you can also override that value in the web.config so you can access it with JS.

<httpCookies httpOnlyCookies="false" requireSSL="false" domain="" />