how to implement remember me in Login screen of MVC 4 application

Question

0.00/5 (No votes)

See more:

Hi,
I have written the following code, I do not know what is the best way to get the user name and password retrieved the next time the user logs in.
Below is the action i call when user submits the user id and password:

SQL

[ValidateAntiForgeryToken]
        [HttpPost]
        [AllowAnonymous]
        public ActionResult Login(Login loginUser,string ReturnUrl = "")
        {
            ViewBag.loginErrorMsg = string.Empty;
            #region Style 1
            if (ModelState.IsValid)
            {
                if (loginUser.Username != null && IsAuthenticated(loginUser))
                {
                    var authTicket = new FormsAuthenticationTicket(
                                                  1,
                                                  loginUser.Username,  //user id
                                                  DateTime.Now,
                                                  DateTime.Now.AddMinutes(20),  // expiry
                                                  loginUser.RemeberMe,  //true to remember
                                                  "", //roles 
                                                  "/"
                                                );

                    //encrypt the ticket and add it to a cookie
                    HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
                    Response.Cookies.Add(cookie);
                    FormsAuthentication.RedirectFromLoginPage(loginUser.Username, false);
                }
                else
                {
                    ViewBag.loginErrorMsg = Constants.LoginErrMsg;
                }
            }
            #endregion

            ModelState.Remove("Password");
            return View();
        }

Although i tried various ways to retrieve the password they did not help.
The code at the Login view action is simple as of now:

SQL

[AllowAnonymous]
      public ActionResult Login()
      {
          return View("Login");
      }

I am not getting the password in the action Login(). Please let me know how can i retrieve the saved password in case the user checked in remember me in his previous login.
[^]

Posted 6-Oct-15 1:31am

tewari.nivedita@gmail.com

Updated 6-Oct-15 1:32am

v2

Add a Solution

Comments

John C Rayan 6-Oct-15 7:43am

Are you sure about this code? IsAuthenticated(loginUser).
Shouldn't be !IsAuthenticated(loginUser)

tewari.nivedita@gmail.com 6-Oct-15 9:32am

IsAuthenticated is good. Cookie is created only when user is a valid user only.
therefore if (loginUser.Username != null && IsAuthenticated(loginUser))
IsAuthenticated(loginUser) - true for valid users

Sinisa Hajnal 6-Oct-15 7:54am

Is cookie created?
Does it contain the ticket?
Can you read the cookie on next login?
Is the ticket still valid?

tewari.nivedita@gmail.com 6-Oct-15 9:33am

Cookie is created and encrypted also. I can't read the cookie at next login. I don't think the ticket is valid till next login.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard Deeming · Answer 1 · 2015-10-06T03:00:00

If you're going to manually create the authentication cookie, then you need to make sure it's set to "HTTP only". This ensures that the cookie cannot be stolen via a Cross-Site Scripting vulnerability.

If you want the user to be remembered, then simply increase the duration of the authentication ticket:

C#

DateTime utcNow = DateTime.UtcNow;

DateTime utcExpires = loginUser.RemeberMe 
    ? utcNow.AddDays(5) 
    : utcNow.AddMinutes(20);

var authTicket = new FormsAuthenticationTicket(
    2,
    loginUser.Username,
    utcNow,
    utcExpires,
    loginUser.RemeberMe,
    string.Empty,
    "/"
);

HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
cookie.HttpOnly = true;

if (loginUser.RemeberMe)
{
    cookie.Expires = authTicket.Expiration;
}

Response.Cookies.Add(cookie);

Attempting to "remember" the user's password is an extremely bad idea, and will lead to serious security vulnerabilities in your application.

How to build (and how not to build) a secure "remember me" feature | Troy Hunt[^]