c# - authCookie and relogin the user -
scenario: have tricky situation need keep many modules happy [google analytics, etc, etc...]. got asp.net page in project initiates request on third party website (after clicking process button) , redirects user third party website. transaction processed on website , control returned current page on our site. can relate scenario kind of paypal processing too, it's not paypal.
issue: if session time out, want user again authenticated when control reaches our website after processing done on third party website. thinking of passing authcookie information third party website , when control reaches our website back, have authcookie information (imagine scenario) , want log user in. can creating authcookie again based on username?
it depends on transaction processing system using. if check result of transaction calling api, response have user id or can tie user id. can store user name in cookie, cookies per domain or subdomain , won't sent transaction processing web site if in different domain yours, case. or derive user name transaction result response, compare 1 obtain cookie. if match up, sign in user. signing user in based on cookie contents risky in many respects. first of can set cookie name in browser. second, if signing in user based on cookie, you'll never expiring session. not want. added security can check transaction time transaction result response , refuse sign in if long ago.
oh, , in question mention "need need keep many modules happy" not expand on mean this. i'm ignoring bit. not sure happy module =)
Comments
Post a Comment