ASP.NET: Build Your Own Security Framework with SetAuthCookie

All of ASP.NET's security/membership support boils down to generating a cookie that allows the user access to your site's folders.

I mentioned SetAuthCookie in a comprehensive look at the ASP.NET security framework about seven years ago, but it's worth mentioning again (primarily because I keep getting asked to solve this problem).

If you find that the ASP.NET Membership provider's security framework gives you too much of a solution -- if you want to authenticate users your own way -- you can. All of ASP.NET's security/membership support boils down to generating a cookie that allows the user access to your site's folders. You can generate that cookie from any process you care to create by using the FormsAuthentication class' SetAuthCookie method, passing the name of the user and a Boolean value.

This call to SetAuthCookie generates a cookie that says this user ("Peter") is authenticated:

FormsAuthentication.SetAuthCookie( "Peter",  False)

The second parameter specifies whether the cookie is an in-memory cookie (no expiry date) or a permanent cookie that will be saved on the user's hard disk. If you specify true in the second parameter, the user will be "permanently" authenticated for your site -- at least, as long as they come to your site from the computer on which the cookie is saved. You can also provide a third parameter as a path for the cookie if you don't want the cookie returned on every request for your site.

This method doesn't completely ignore the settings in your web.config file. If, for instance, you've set the cookieless attribute on the forms element to AutoDetect, ASP.NET will attempt to determine if the current client supports cookies (it reports that through the FormsAuthentication's CookieSupported property). If cookies aren't supported, the SetAuthCookie method ensures that the authentication information is put in the URL.

This method doesn't directly support roles, so you'll have to authorize access to your site's folders by user name rather than by role.

About the Author

Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at

comments powered by Disqus


  • Death of the Dev Machine?

    Here's a takeaway from this week's Ignite 2020 event: An advanced Azure cloud portends the death of the traditional, high-powered dev machine packed with computing, memory and storage components.

  • COVID-19 Is Ignite 2020's Elephant in the Room: 'Frankly, It Sucks'

    As in all things of our new reality, there was no escaping the drastic changes in routine caused by the COVID-19 pandemic during Microsoft's big Ignite 2020 developer/IT pro conference, this week shifted to an online-only event after drawing tens of thousands of in-person attendees in years past.

  • Visual Studio 2019 v16.8 Preview Update Adds Codespaces

    To coincide with the Microsoft Ignite 2020 IT pro/developer event, the Visual Studio dev team shipped a new update, Visual Studio 2019 v16.8 Preview 3.1, with the main attraction being support for cloud-hosted Codespaces, now in a limited beta.

  • Speed Lines Graphic

    New for Blazor: Azure Static Web Apps Support

    With Blazor taking the .NET web development world by storm, one of the first announcements during Microsoft's Ignite 2020 developer/IT event was its new support in Azure Static Web Apps.

  • Entity Framework Core 5 RC1 Is Feature Complete, Ready for Production

    The first release candidate for Entity Framework 5 -- Microsoft's object-database mapper for .NET -- has shipped with a go live license, ready for production.

Upcoming Events