Form身份验证跨二级域名验证的问题

Question

你好，我有两个网站，一个域名是a.test.com,一个是b.test.com，我需要两个网站之间实现验证cookie共享。我配置了web.config，设定了验证时cookied的域名

<authentication mode="Forms">
      <forms loginUrl="Login.aspx" domain="test.com" defaultUrl="Default.aspx" timeout="1200" slidingExpiration="true" name=".ASPXAUTH"/>
    </authentication>

同时也设置了

<machineKey validationKey="C9E0C488F13456667414E4557320C91A11A1AD6F9506448D4BE574DF075DDEF6D1D430C51554CD25687FC8170A633E00FD64C3E93FAF04A613922EE08BF844A8" decryptionKey="2BC92C6FC0B5587CB77F793AF3DEDBE99242CDE0201589CC" validation="SHA1"/>

两个网站不在同一个服务器上，a.test.com通过验证生成了.ASPXAUTH的cookie，且domain值是.test.com，访问b.test.com时，从fiddler中可以看到向b.test.com发送了.ASPXAUTH的cookie。但是在b.test.com通过request.cookies查看时，没有.ASPXAUTH的cookie。

为了测试该问题，我在a.test.com生成了一个其他名字的cookie，设置了domain为.test.com，却发现该cookie能够在b.test.com得到。

ttpCookie testcookie = new HttpCookie("test");
            testcookie.Value = "test";
            testcookie.Domain = ".overmcse.com";
            Response.Cookies.Add(testcookie);

请问这是怎么回事？

---

...

Answer 1

参考下面的这个试下  Single Sign On (SSO) for cross-domain ASP.NET applications

http://www.codeproject.com/Articles/106439/Single-Sign-On-SSO-for-cross-domain-ASP-NET-applic

http://www.codeproject.com/Articles/114484/Single-Sign-On-SSO-for-cross-domain-ASP-NET-appl

---

专注于.NET MIS开发框架，C/S架构，SQL Server + ORM(LLBL Gen Pro) + Infragistics WinForms

Answer 2

Hi Chivas_Tan,

你的情况应该是设置domian相同后cookie共享成功了吧，所以获取到的是相同的。

参考链接：

请问在不同服务器上 相同域名的程序 是否可以共享cookie

Regards,

Moonlight

---

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click HERE to participate the survey.

Answer 3

不，关键的用于Form身份验证的COOKIE并未共享。From认证的cookie.ASPXAUTH没有传递从A.TEST.COM传递到B.TEST.COM

---

...

Answer 4

Hi,

我想可能是哪边有对这个cookie进行了更新操作，然后把数据刷没了，不然也不会出现这种共享成功对应值消失的问题。

Regards,

Moonlight

---

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click HERE to participate the survey.

Answer 5

我发现了，ASPXAUTH此类COOKIE是不会包含在request.cookie中。而是要通过FormsAuthentication.GetAuthCookie的方式来获得。

var cookie = FormsAuthentication.GetAuthCookie(".ASPXAUTH", false);
var ticket = FormsAuthentication.Decrypt(cookie.Value);

但是，无法解密...虽然他们配置了相同的machineKey

---

...