Re: Remember Me Checkbox via login control

I looked at this tutorial, and the solution it provides as an example is not
secure, as it assumes that whoever is using the computer after the logged-in
member is logged in and checks the "Remember Me" checkbox is the same
person, and automatically authenticates that person.

I did a slight modification of this, which I've posted below. This solution
simply remembers the user's UserName, and if "Remember Me" is checked, it
stores the UserName in a cookie, and populates the Login Name TextBox with
the cookie's value, and sets the focus on the Password TextBox. The User
must then type in the Password to log in. In addition, if the "Remember Me"
CheckBox is UNchecked, it will *delete* the cookie that remembers the
UserName.

protected void Page_Load(object sender, EventArgs e)
{
bool cookieExists = (Request.Cookies["authUser"] != null);
Login1.RememberMeSet = cookieExists;
if (cookieExists)
{
HttpCookie cookie = Request.Cookies.Get("authUser");
string authUserName = cookie.Values["authUserName"];
string authPassword = cookie.Values["authToken"];
TextBox txtUserName = (TextBox)Login1.FindControl("UserName");
txtUserName.Text = authUserName;
((TextBox)Login1.FindControl("Password")).Focus();
}
}


protected void Login1_LoggedIn(object sender, EventArgs e)
{
CheckBox rm = (CheckBox)Login1.FindControl("RememberMe");
bool _RememberChecked = rm.Checked;
if (_RememberChecked)
{
HttpCookie authUser = new HttpCookie("authUser");
Response.Cookies.Remove("authUser");
Response.Cookies.Add(authUser);
authUser.Values.Add("authUserName", this.Login1.UserName);
authUser.Values.Add("authToken", this.Login1.Password);
DateTime dtExpiry = DateTime.Now.AddDays(15);
Response.Cookies["authUser"].Expires = dtExpiry;
}
else Response.Cookies["authUser"].Expires = DateTime.Now.AddDays(-10);
}

--
HTH,

Kevin Spencer
Microsoft MVP

Printing Components, Email Components,
FTP Client Classes, Enhanced Data Controls, much more.
DSI PrintManager, Miradyne Component Libraries:
http://www.miradyne.net


"Michael Nemtsev" <nemtsev@xxxxxxx> wrote in message
news:a279a63a3ed1688c9509780996291@xxxxxxxxxxxxxxxxxxxxxxx
Hello Frank,

It's not worked by default
see the working sample over there
http://www.codeproject.com/useritems/Remember_me_next_time.asp

---
WBR, Michael Nemtsev [.NET/C# MVP]. My blog:
http://spaces.live.com/laflour
Team blog: http://devkids.blogspot.com/

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

FM> Hi,
FM> FM> My boss is having a fit over the fact that the "Remember Me"
FM> checkbox doesn't stay checked when he visits the site after the
FM> initial visit.
FM> FM> Any tips on how I might go about doing this?
FM> FM> Thx,
FM> Frank




.

Relevant Pages

  • CheckBox CheckChanged EventHandler not working?
    ... I have a login page with two checkboxes, one for automatic login and the ... other for remember username. ... CheckBox cb = new CheckBox; ... private void cb_CheckedChanged(object sender, EventArgs e) { ...
    (microsoft.public.dotnet.languages.csharp)
  • [UNIX] YaBB Security Vulnerabilities (CSS in Login, Insecure Password Handling)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attacker to steal user's cookies, hijacking user's accounts, and more. ... stealing the username cookie is easy. ...
    (Securiteam)
  • [NEWS] AudioGalaxy Username and Password Saved in Cleartext
    ... that offers an mp3 sharing program. ... This product stores the username and ... password used by the application in plain text inside a cookie - this ... AudioGalaxy keeping usernames and passwords in clear text in a file on the ...
    (Securiteam)
  • Re: FormsAuthentication Cookie
    ... Also assume that the username of the ... Sub Page_Load ... Internet Files folder & click the cookie, I find that the cookie has ... first parameter in the methods RedirectFromLoginPage & GetAuthCookie? ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Disable username, password and domain prompt
    ... there is no "Always prompt for a username and password" ... checkbox, and the "Logon network security" is already set to "Kerberos ... Brian Tillman wrote: ...
    (microsoft.public.outlook)