Re: Forms Authentication and cached pages

Hi Lizet,

It seems IE does not store the file in its temporary Internet files
folder whenever the server specifies the "no-store" http cache directive
(yes, in my opinion this is a bug) [1]; as a consequence, it cannot feed
Acrobat/Excel or whatever external application with the output of your page.
I suggest you to remove this cache header whenever you need to send to
the client a file to be opened this way.

[1] http://support.microsoft.com/kb/243717/en-us

HTH,

Efran Cobisi
http://www.cobisi.com

Lizet Pena de Sola wrote:
> We had an interesting side effect though. We generate PDF reports and
> excel reports on the fly. After setting up that http header directive,
> the reports stopped to work. IE wouldn't recognize the file name and
> gave error when the user tried to open or save the report...
> interesting.
>
> -----Original Message-----
> From: Discussion of building .NET applications targeted for the Web
> [mailto:[email protected]] On Behalf Of Pena, Lizet
> (Consultant)
> Sent: Wednesday, March 21, 2007 1:03 PM
> To: [email protected]
> Subject: Re: [DOTNET-WEB] Forms Authentication and cached pages
>
> Hello Efran,
> We put this directive in the base class we use to inherit the pages
> from, on the Init() event and the pages are no longer cached on the
> client.
> Thanks for the help,
> Lizet
>
> -----Original Message-----
> From: Discussion of building .NET applications targeted for the Web
> [mailto:[email protected]] On Behalf Of Efran Cobisi
> Sent: Wednesday, March 21, 2007 11:11 AM
> To: [email protected]
> Subject: Re: [DOTNET-WEB] Forms Authentication and cached pages
>
> Hello Lizet,
>
> Afaik, setting the cache control of your http response to no-store would
> do the trick. You could use the following line of code [C#] before
> issuing the last redirect:
>
> Context.Response.Cache.SetNoStore();
>
> HTH,
>
> Efran Cobisi
> http://www.cobisi.com
>
> Lizet Pena de Sola wrote:
>
>> Hi all,
>> I'm reviewing a web project that uses Forms authentication.
>> After the authentication process we create an encrypted ticket, create
>> the cookie that will be used by the FormsAuthentication provider and
>> redirect to the requested page:
>> Dim isCookiePersistent As Boolean = False
>> Dim authTicket As New FormsAuthenticationTicket(1, UserName,
>> DateTime.Now, DateTime.Now.AddMinutes(60), isCookiePersistent,
>>
> UserData)
>
>>             Dim encryptedTicket As String =
>> FormsAuthentication.Encrypt(authTicket)
>>
>>             Dim authCookie As New
>> HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
>>
>>             If (isCookiePersistent) Then
>>                 authCookie.Expires = authTicket.Expiration
>>             End If
>>
>>
>>             Context.Response.Cookies.Add(authCookie)
>>             FormsAuthentication.RedirectFromLoginPage(UserName, False)
>>
>>
>>
>> During user log out we clear the session, call the
>> FormsAuthentication.SignOut() and redirect the user to the login page.
>>
>> We have, however, an odd behavior. After the user has logged out of
>>
> the
>
>> application, he can, by clicking the back button on the same browser
>> windows, navigate to the previous pages he opened. These pages are in
>> the secure area. These pages are not requested to the server, these
>> requests do not hit the server so I presume the user sees cached pages
>> in the client.
>>
>> Any suggestion on how to avoid this is more than welcome,
>>
>>
>>
>> Lizet
>>
>> ===================================
>> This list is hosted by DevelopMentor(r)  http://www.develop.com
>>
>> View archives and manage your subscription(s) at
>>
> http://discuss.develop.com
>
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>
> ===================================
> This list is hosted by DevelopMentor®  http://www.develop.com
>
> View archives and manage your subscription(s) at http://discuss.develop.com
>

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com