Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...REMEMBER PASSWORD??? DOES THIS EVEN WORK?REMEMBER PASSWORD??? DOES THIS EVEN WORK?
Previous
 
Next
New Post
12/15/2006 2:40 PM
 

DotNetNuke Modules from Snapsis.com
 
New Post
12/15/2006 3:11 PM
 
Thanks for the links John... so basically, in DotNetNuke at this time, there is no difference between Persistent and Temporary cookies. What value is set for Forms Authentication Timeout applies to both... Cathal hopes to get a fix in for this sometime after the initial 4.4 release.

Primarily, this affects your Session timeout vs. the ability for you to be logged in automatically when you revisit a site... If you set the value to be really high, user's Sessions will persist for that long which could be a security risk and eat up server resources. If you set it low, the whole remember me thing is pretty much useless.

To me, the priority of this fix really needs to be bumped up.

David O'Leary
Efficion Consulting
 
New Post
12/15/2006 3:52 PM
 

No, There is still a difference in persistent and temporary cookies.  This issue relates to the Forms Authentication cookie, a cookie created by the asp.net framework.

You can make a Forms Auth cookie persistent which DotNetNuke does if the remember me checkbox is checked.  The expiration of the persistent cookie is determined by the timeout value.

It's not related to the Session timeout in any way that I know of, unless you count that when you have a persistent cookie and your session times out the cookie will be there to re-authorize you.

So it's not really that the session is being extended, it's just that the cookie being on someones machine for a longer length of time without expiring poses a greater security risk than if it expired sooner.  

Think of it this way.  I own a very exclusive and private night club, and I want to allow my customers to come back and not have to go through a lengthy process to get in if they have already proven themselves worthy to enter.  So I issue them an exclusive ID card to be presented when they return.  I would then probably want to make sure that the card expired in less than 50 years so that I wouldn't have 100's of thousands of them floating around and being traded on the black market (hey, it's a really cool club).

Now in ASP.Net 2.0 that timeout is minimized to almost nothing "out of the box".  So it is then up to the developer/owner of the application to increase the risk to a longer time if desired.

DotNetNuke makes it 60 minutes by default, which really confuses a lot of people about the "remember me" functionallity since it will remember you, but only if you keep refreshing it's memory by showing yourself every 60 minutes.

Personally, I think DNN should default it to a week, but since I can change it myself, it is not that big a deal.


DotNetNuke Modules from Snapsis.com
 
New Post
12/16/2006 11:25 AM
 
Personally, I think DNN should default it to a week, but since I can change it myself, it is not that big a deal.

Except that us newbies have no idea about this.  Hopefully, the DNN developers realize that DNN is being installed and used by non ASP.NET programmers.  It is no longer a sample project provided by Microsoft for ASP.NET programmers to learn from.  It is now a very useful product being used by people who know nothing about web development to create rich content portals.

Changing the default value to one week would definitely prevent a lot of hair loss.  What is the maximum value for this timeout?  After all, if a user clicks "Remember Me", the user expects the site to do just that.

Thanks
 
New Post
12/16/2006 11:54 AM
 


I agree with you Jon.  I'll let the rest of the team know, but right now I think it is in Cathal's hands.

The maximum is a very large value (something like 50 years).


DotNetNuke Modules from Snapsis.com
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...REMEMBER PASSWORD??? DOES THIS EVEN WORK?REMEMBER PASSWORD??? DOES THIS EVEN WORK?


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out