Shared login in two MVC Projects? Why?

Question

Imagine when you create a new MVC4 Project and you start registering an account using SimpleMembership and you logged using Remember Me checkbox.

Now, when you create another MVC 4 Project, the application tries to loggin using the previous account, although throws an error because it does not exist. I mean, if a do a login in a web page, the another one uses the same account.

How can avoid this, I guess has to be with ForgeryTokens or something like that

Are you using different application names in the web.config files? — System Down, May 21 '13 at 22:35
Cookies are shared on a domain/subdomain basis. Ports are not taken into account. So, this is sort of an edge case scenario that will mostly bite you in dev (running everything on localhost), if the apps share the same domain in *production* they really should share logins anyways, just from a logical UX perspective. — Chris Pratt, May 22 '13 at 01:22

score 1 · Answer 1 · answered May 21 '13 at 22:56

1

Customize the name of the cookie so that it's unique per application.

<authentication mode="Forms">
    <!-- **Defaults** timeout="30" slidingExpiration="true" -->
    <forms name=".MyApplication" defaultUrl="~/" loginUrl="~/LogIn"  />
</authentication>

answered May 21 '13 at 22:56

Nick Albrecht

16,607
10
66
101

score 0 · Answer 2 · answered May 22 '13 at 01:09

if you are using a single sign on mechanism then it is a exceptionable scenario but if you do not wish to allow the same authentication with same account to another website then make sure the web.config file for both projects must have a different machine keys.

Also, this is happened because of cookies on your machine is set to true, to create cookies file and allow access to other project using this cookies details.

< Authentication />

score 0 · Answer 3 · edited May 23 '17 at 12:05

It happens because when the web page is served the browser sees localhost as the domain name. It saves the cookie for localhost.

When you host another website on the same server with localhost, then the browser sends the same cookie again.

If you are using the same cookie name in both the applications, then the system will try to think that the user is already authenticated and you will get the error.

You can change the cookie name in web.config file.

Read this:

Can I change the FormsAuthentication cookie name?

Shared login in two MVC Projects? Why?

3 Answers3