Hi,
I have a web application with a login form. A user enters a user name and password. If they exist in the database the user is authenticated using these two lines:
FormsAuthentication.SetAuthCookie(userName, false);
FormsAuthentication.RedirectFromLoginPage(userName, false);
The problem is that when a user logs in at first he is logged in as himself. When navigating on the web application for a while the user assumes the identity of another logged in user. This happens all the time.
In my web.config the authentication mode looks like this:
<authentication mode="Forms">
<forms loginUrl="LogOn.aspx" name=".ASPXFORMSAUTH">
</forms>
</authentication>
<authorization>
<deny users="?" />
</authorization>
The site does not use ASP.NET session variables. Instead each page initializes ...
Go to the complete details ...