FormsAuthentication ASPXAUTH Cookie WCF and JSON

Question

I have a WCF web service that expose functions to get X informations. The service return the informations in JSON format. What I need to do if I want to secure this web service? Not using default IIS security, I want to use custom login (with database verification).

The client application from where I want to show the X informations make JQUERY and AJAX calls. First, I have a login page where I can enter user name and password (encrypted in MD5). The client call the service with these informations and the service return YES if the user is valid (simple select on a postgresql database) or false. For the moment, I initiate a FormsAuthentication object and add it to the cookie.

Private Function SetAuthCookie(name As String, rememberMe As Boolean, userData As String) As Integer

    ' In order to pickup the settings from config, we create a default cookie and use its values to create a new one.
    Dim cookie As HttpCookie = FormsAuthentication.GetAuthCookie(name, rememberMe)
    Dim ticket As FormsAuthenticationTicket = FormsAuthentication.Decrypt(cookie.Value)

    Dim newTicket As New FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, userData, ticket.CookiePath)
    Dim encTicket As String = FormsAuthentication.Encrypt(newTicket)

    ' Use existing cookie. Could create new one but would have to copy settings over...
    cookie.Value = encTicket

    HttpContext.Current.Response.Cookies.Add(cookie)

    Return encTicket.Length
End Function

Secondly, I see that when I do calls from the client code, the .ASPXAUTH cookie is passed for each calls. But, what I need to do on the server side to validate that this is a good user and not a "stolen" cookie ASPXAUTH code? I don't think that this little isValidUser function is enough to valid the call.

Private Function isValidUser() As Boolean
    Dim cookie As HttpCookie = HttpContext.Current.Request.Cookies(FormsAuthentication.FormsCookieName)

    If cookie Is Nothing Then Return False

    Dim decrypted = FormsAuthentication.Decrypt(cookie.Value)

    If String.IsNullOrEmpty(decrypted.UserData) Then Return False

    Return True
End Function

Best regards,

Anders Abel Anders Abel · Accepted Answer · 2012-07-05T20:40:17

From what you describe, I assume that you are running your WCF service using an http binding inside IIS.

If you enable forms authentication in web.config the ASP.NET engine will take care of reading the auth cookie and setting the identity of the thread processing the request. You shouldn't have to deal with the cookie directly. To check if the user is authenticated, check the HttpContext.Current.User.Identity.IsAuthenticated property.

FormsAuthentication ASPXAUTH Cookie WCF and JSON

1 Answers