Manual Sign Out in ASP.NET Forms Authentication

July 28, 2008 at 10:03 AMAmer Gerzic

Recently I have been developing numerous applications in ASP.NET and Flex Builder 3. For security I utilized forms authentication as provided by ASP.NET engine. At first, everything worked well until there was a need to manually sign out current user. Quick look into MSDN documentation revealed SignOut() method of FormsAuthentication class. The documentation promised that this method signs out the user and redirects the client to login page. Considering the fact that I did not care about redirect (Flex application was running on the client side, so that redirection did not have any effect), I was hoping that the method would still perform desired effect and "de-authenticate" (I know, I know, that is not even a word) current user. At first, it seemed to work, but debugging revealed that even though this method removed authentication cookie, it did not sign out the user. User's identity was still marked as authenticated and subsequent calls to the Http handler would be considered authenticated. Furthermore, the session object was still valid, so that existing session information was still available. Quick look into MSDN revealed Session.Abandon() method, which would destroy session object upon execution. However, even though the session object was destroyed, client calls to ASP.NET web application were still considered authenticated. It was time to search the web to see if other developers faced the same issue.

After some research I ran into following Microsoft article: http://support.microsoft.com/kb/900111. The article explains that FormsAuthentication.SignOut() method does not prevent cookie reply attack, which essentially means that the cookie, even though it was destroyed, it was considered to be valid and all calls to the application that utilized this particular cookie were considered authenticated. The same article presented some possible workarounds, but it did not satisfy my needs. It bugged me that in order to prevent the access to secure parts of the application (even after log off), I had to track the security on client side (in addition to server side). So I tried following code:

/* Create new session ticket that expires immediately */
FormsAuthenticationTicket ticket =
    new FormsAuthenticationTicket(
        1,
        context.User.Identity.Name,
        DateTime.Now,
        DateTime.Now,
        false,
        Guid.NewGuid().ToString()); 

/* Encrypt the ticket */
string encrypted_ticket = FormsAuthentication.Encrypt(ticket); 

/* Create cookie */
HttpCookie cookie = new HttpCookie(
    FormsAuthentication.FormsCookieName,
    encrypted_ticket); 

/* Add cookie */
context.Response.Cookies.Add(cookie); 

/* Abandon session object to destroy all session variables */
context.Session.Clear();
context.Session.Abandon();

Essentially the code replaces old cookie with new security cookie that expires immediately, which performs user sign out. In addition, all session variables are destroyed and new session is created so that old session cannot be reused. However, it is essential to mention that the technique presented in this post does not prevent Cookie Reply Attack. The old cookie is still valid for the duration specified in FormsAuthenticationTicket constructor.

Posted in: ASP.NET

Tags: ,

Creating custom entry renderer for Adobe Flex Schedule Viewer

July 15, 2008 at 11:09 AMAmer Gerzic

Last couple of weeks I have been coding a lot of Flex, specifically ScheduleViewer component included in flexlib version 1.9. I was mostly happy with ScheduleViewer component but I did have some minor annoyances. Actually, it was more curiosity than need that drove me to investigate the possibility of creating a custom entry renderer for ScheduleViewer component. As it turns out, it was very easy. Investigating the source code of the library, I noticed the component AbstracSolidScheduleEntryRenderer. This component was responsible for simple entry rendering, which I wanted to modify. Specifically, I wanted to modify the content of each schedule entry i.e. the date object was simply formatted as time rather than a date. Because of the fact that my schedule was really date related (rather than time related), I needed a renderer that would meet my needs. Let's look at the code of MyEntryRenderer.mxml:

<?xml version="1.0" encoding="utf-8"?>
<renderers:AbstractSolidScheduleEntryRenderer 
    xmlns:mx="http://www.adobe.com/2006/mxml" 
    xmlns:renderers="flexlib.scheduling.scheduleClasses.renderers.*" 
    paddingTop="0" 
    paddingLeft="0">
        
    <mx:Script>
        <![CDATA[
            import mx.formatters.DateFormatter;
            import flexlib.scheduling.scheduleClasses.IScheduleEntry;
            
            private var formatter:DateFormatter;
            
            override public function onPreinitialize() : void
            {
                formatter = new DateFormatter();
                formatter.formatString = "MM/DD";
            }
            
            override public function set data ( value : Object ) : void
            {
                super.data = value;
                
                entry = value as IScheduleEntry;
                var content : SimpleScheduleEntry = SimpleScheduleEntry( entry );
                
                drawTextContent(content);
            }
            
            protected function drawTextContent(content : SimpleScheduleEntry) : void
            {   
                formatter.error = "";
                
                var time : String = formatter.format( content.startDate ) 
                 + " - " + formatter.format( content.endDate );
                
                toolTip = time + "\n" + content.label;
                contentLabel.text = time;
                contentLabel.styleName = getStyle( "timeStyleName" );
                contentText.text = content.label;       
            }
        ]]>
    </mx:Script>
    
    <mx:Label id="contentLabel" />
    <mx:Text id="contentText" />
    
</renderers:AbstractSolidScheduleEntryRenderer>

From the code above it is clear that we are simply customizing existing component to meet our needs. Similar to any custom components in Flex, we are simply modifying the content of an existing component by using DateFormatter object. The function DrawTextContent is responsible to set the content of the text box and a label found on AbstractSolidScheduleEntryRenderer. This function is called by setter function of the data member of the AbstractSolidScheduleEntryRenderer, which is called by ScheduleViewer component during the drawing phase. Once the customization is performed, we simply have to specify that we want to use the new renderer in following way:

<ns1:ScheduleViewer
    id="MyScheduleViewer" 
    width="800" 
    height="100%"
    rowHeight="25"
    startDate="{ StartDate }"
    endDate="{ EndDate }"
    verticalGridLineAlpha=".1"
    horizontalGridLineAlpha=".1"
    entryRenderer="MyEntryRenderer"
    entryLayout="flexlib.scheduling.scheduleClasses.layout.SimpleLayout"
    color="#FFFFFF"
    borderColor="#FFFFFF" 
    themeColor="#FFFFFF" 
    backgroundColor="#FFFFFF" 
    click="OnScheduleClick(event)" />

As we can see from the code above, all we needed to do is set entryRenderer property to be our newly defined component. One thing to note is that we do have to set entryLayout property to be "…layout.SimpleLayout", because only then the rendering is performed using AbstractSolidScheduleEntryRenderer. At this point the customization is finished.

Posted in: Adobe Flex

Tags:

Setting up debugging environment - ASP.NET and Flex Builder

July 11, 2008 at 9:07 PMAmer Gerzic

Unlike Silverlight, Flex Builder does not integrate with Visual Studio programming environment. Therefore, debugging ASP.NET or Flex applications can become very cumbersome, especially when they become very large. However, with Flex Builder 3, Adobe has made possible to utilize built in ASP.NET web server (Cassini) to debug Flex applications. Following post describes one possible way to set up both environments to make debugging easier.

More...

Posted in: .NET | Adobe Flex | ASP.NET

Tags: , , ,

Adobe Flex and ASP.NET authentication using HTTPService and IHttpHandler

June 27, 2008 at 8:45 AMAmer Gerzic

Lately, Adobe Flex has been getting more and more attention in programming community. Especially after the launch of open source version of Flex SDK developers are able to make rich Internet applications (RIA) using Flex, which (as everybody knows) produces a flash file (swf) that can be used in any web application. The article will focus on the following topics:

  1. Communication between Action Script (HTTPService) and .NET (HTTP Handler);
  2. Security - securing HTTP Handler calls from unauthorized access;
  3. ASP.NET Forms Authentication and Authorization through Flex;
  4. ASP.NET Handlers and session management;

It is assumed that the reader is familiar with basic concepts of ASP.NET handlers, forms authentication, and Adobe's Action Script.
More...

Posted in: Adobe Flex | ASP.NET | C#

Tags: , , , , ,

Creating and linking CLR stored procedures for SQL Server 2005

May 18, 2008 at 10:24 AMAmer Gerzic

SQL Server 2005 has been released for a while now, and most of the new features are well known throughout programming community. Right after the initial release, I downloaded a copy of SQL Server 2005 Express, eager to explore new features. At first, there was a lot of reading and browsing the documentation; then I moved onto converting smaller projects to SQL Server 2005 edition, and finally I decided to move larger projects to my new favorite DBMS. Throughout conversion process, I was poised to utilize the newest feature of SQL Server 2005: CLR Stored Procedures.
More...

Posted in: .NET | C# | SQL Server

Tags: , , ,