asp.net mvc 3 forms authentication and ie9

Question

Well I'm totally stumped on this one. Here is the scenario asp.net mvc3 web application, has been working fine for quite a few months, but I have been going through patches and new releases weekly or so with new functionality. The codebase itself runs on two separate iis7 windows r2 servers. One of these servers, I dont use the standard app pool identity (network service) - I have a specific user, since it pulls some files off a file server, and hence needs specific rights too add/delete from that directory.

On this server, its just started to act crazy with forms authentication 99% of the time in IE9, once or twice I've got to do it on chrome, but chome/ff usually behave themselves no problems.

The problem is as soon as you log in, and go to another page, it keeps responding with a object moved, and redirecting to the login page again. (Sometimes it even does this on logging in) However the session is still valid, because as part of the template, it shows menu items that are based off having the user authenticated, with calls like

Context.User.IsInRole(xxxx)
Request.IsAuthenticated

I've fiddled it, and cookie sessions seem to be fine, everything is being set as it should.

However, if I do a complete iisreset, ie9 will work for about 5 minutes, then it just fails for every request, and redirects back to the login page.

I'm not using iframes at all in the web application, and my web.config settings are

<sessionState mode="InProc" timeout="80" />
<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="40" slidingExpiration="true" cookieless="UseCookies" />
</authentication>

Time sync has been checked, and both client(s) and server are within 1 second of each other.

So at this stage, I'm stuck, I don't know where to go to troubleshoot further, or anything else I can try. I can remotely debug the server, if need be.

When I test locally on my dev box, I'm not seeing any issues.

Thanks, Cameron

score 1 · Accepted Answer · answered Jun 11 '12 at 23:57

Problem solved. I had the number of worker processes set to 2 for the app pool, and hence it was a lucky pot dip as to which of the 2 worker processes had my validated form cookie/session.

Changed back to 1 and the application works as expected. However I'm going to completely rewrite my session handling and store in a db, so I can increase this worker processes to 4 or so to make the app more efficient.

score 0 · Answer 2 · answered Jun 08 '12 at 05:06

If you are using FormAuthenticationTicket, check below.

FormsAuthenticationTicket authTicket = new
                           FormsAuthenticationTicket(1, //version
                           username, // user name
                           DateTime.Now,             //creation 
                           DateTime.Now.AddDays(5), //<--- THIS  Expiration 
                           remember, //Persistent
                           userdata);

asp.net mvc 3 forms authentication and ie9

2 Answers2