Styjun

I'm finding that I can, so I must be confused about cookies.

********** SETUP SECTION **********

I've done the following:

1. Visual Studio 2017: File -> New Project -> ASP.NET Core Web Application -> Web Application (Model-View-Controller). All defaults (so No Authentication, and Configure for HTTPS checked true). Solution Explorer will look like this:

2. 
   

   In Startup.cs, I modified ConfigureServices:

   
   
   

   public void ConfigureServices(IServiceCollection services)
   
    // THIS WAS COMMENTED OUT
    //services.Configure<CookiePolicyOptions>(options =>
    //
    // // This lambda determines whether user consent for non-essential cookies is needed for a given request.
    // options.CheckConsentNeeded = context => true;
    // options.MinimumSameSitePolicy = SameSiteMode.None;
    //);
   
    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
   
    // THIS WAS ADDED
    services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = false;
    options.ExpireTimeSpan = TimeSpan.FromSeconds(20);
    );
   
   

   
   


3. 
   

   In Startup.cs, I modified Configure:

   
   
   

   public void Configure(IApplicationBuilder app, IHostingEnvironment env)
   
    if (env.IsDevelopment())
    
    app.UseDeveloperExceptionPage();
    
    else
    
    app.UseExceptionHandler("/Home/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
    
   
    app.UseHttpsRedirection();
    app.UseStaticFiles();
    // THIS WAS COMMENTED OUT
    //app.UseCookiePolicy();
    // THIS WAS ADDED
    app.UseAuthentication();
   
    app.UseMvc(routes =>
    
    routes.MapRoute(
    name: "default",
    template: "controller=Home/action=Index/id?");
    );
   
   

   
   


4. 
   

   In the class for the HomeController.cs that's created for you, I added an [Authorize] tag:

   
   
   

    [Authorize]
    public class HomeController : Controller
    {
   

   
   


5. 
   

   I added a new class file to the Models folder called AccountModel.cs, this is what it looks like:

   
   
   

   namespace WebApplication1.Models
   
    public class LoginViewModel
    
    [Required]
    [Display(Name = "Email")]
    [EmailAddress]
    public string Email get; set; 
   
    [Required]
    [DataType(DataType.Password)]
    [Display(Name = "Password")]
    public string Password get; set; 
   
    [Display(Name = "Remember me?")]
    public bool RememberMe get; set; 
    
   
   

   
   


6. 
   

   I created a New folder called Data and added a new class file called ApplicationUser.cs:

   
   
   

   namespace WebApplication1.Data
   
    public class ApplicationUser
    
    public string Email get; set; 
    public string FullName get; set; 
    
   
   

   
   


7. 
   

   I added a new class file to the Controllers folder called AccountControleler.cs, this is what it looks like:

   
   
   

   namespace WebApplication1.Controllers
   
    public class AccountController : Controller
    
    public IActionResult Login()
    
    return View();
    
   
    [HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> Login(LoginViewModel model, string returnUrl)
    
    if (!ModelState.IsValid)
    
    return View(model);
    
   
    ApplicationUser appUser = await AuthenticateUser(model.Email, model.Password);
   
    if (appUser == null)
    
    ModelState.AddModelError("", "Invalid login attempt.");
    return View(model);
    
   
    List<Claim> claims = new List<Claim>
    
    new Claim(ClaimTypes.Name, appUser.FullName),
    new Claim("FullName", appUser.FullName),
    new Claim(ClaimTypes.Email, appUser.Email),
    new Claim(ClaimTypes.Role, "Administrator")
    ;
   
    ClaimsIdentity claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
   
    AuthenticationProperties authProperties = new AuthenticationProperties();
   
    await HttpContext.SignInAsync(
    CookieAuthenticationDefaults.AuthenticationScheme,
    new ClaimsPrincipal(claimsIdentity),
    authProperties);
   
    return RedirectToLocal(returnUrl);
    
   
    private async Task<ApplicationUser> AuthenticateUser(string email, string password)
    
    await Task.Delay(500);
   
    if (email == "so@test.com")
    
    return new ApplicationUser()
    
    Email = "so@test.com",
    FullName = "Stack Overflow"
    ;
    
    else
    
    return null;
    
    
   
    private ActionResult RedirectToLocal(string returnUrl)
    
    if (Url.IsLocalUrl(returnUrl))
    
    return Redirect(returnUrl);
    
    return RedirectToAction("Index", "Home");
    
    
   
   

   
   


8. 
   

   I created a New folder under the Views folder called Account and added a new class view called Login.cshtml:

   
   
   

   @model WebApplication1.Models.LoginViewModel
   @
    ViewData["Title"] = "Login";
   
   
   <h2 class="text-primary">@ViewBag.Title</h2>
   <div class="row">
    <div class="col-md-8">
    <section id="loginForm">
    @*https://dustinewers.com/how-to-build-html-helpers-like-html-beginform-in-asp-net-mvc/*@
    @*https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.rendering.ihtmlhelper.beginform?view=aspnetcore-2.2*@
    @*@Html.BeginForm("Login", "Account",TModel-routeValues,FormMethod.Post, bool?-AntiforgeryExtensions, TModel-htmlAttributes)*@
    @using (Html.BeginForm("Login", "Account", new ReturnUrl = ViewBag.ReturnUrl , FormMethod.Post, null, new @class = "form-horizontal", role = "form" ))
    
    @Html.AntiForgeryToken()
    <h4 class="text-primary">Use a local account to log in.</h4>
    <hr />
    @Html.ValidationSummary(true, "", new @class = "text-danger" )
    <div class="form-group">
    @Html.LabelFor(m => m.Email, new @class = "col-md-2 control-label" )
    <div class="col-md-10">
    @Html.TextBoxFor(m => m.Email, new @class = "form-control" )
    @Html.ValidationMessageFor(m => m.Email, "", new @class = "text-danger" )
    </div>
    </div>
    <div class="form-group">
    @Html.LabelFor(m => m.Password, new @class = "col-md-2 control-label" )
    <div class="col-md-10">
    @Html.PasswordFor(m => m.Password, new @class = "form-control" )
    @Html.ValidationMessageFor(m => m.Password, "", new @class = "text-danger" )
    </div>
    </div>
    <div class="form-group">
    <div class="col-md-offset-2 col-md-10">
    <div class="checkbox">
    @Html.CheckBoxFor(m => m.RememberMe)
    @Html.LabelFor(m => m.RememberMe)
    </div>
    </div>
    </div>
    <div class="form-group">
    <div class="col-md-offset-2 col-md-10">
    <input type="submit" value="Log in" class="btn btn-default btn-primary" />
    </div>
    </div>
    <p>
    @Html.ActionLink("Register as a new user", "Register")
    </p>
    @* Enable this once you have account confirmation enabled for password reset functionality
    <p>
    @Html.ActionLink("Forgot your password?", "ForgotPassword")
    </p>*@
    
    </section>
    </div>
   </div>
   

   
   



9. This is my browser settings (IE11) for cookies:

********** HERE IS WHAT IT LOOKS LIKE WHEN I RUN THE APP **********

Based on what I have set-up, when I run the app, it will take me to the Login Page and I can't get to any of the Home, or Privacy Views until I login. This works. That's not the issue.

I wanted to see what happened if I disabled cookies on the browser. I know I disabled cookies correctly because if I try to log-in to facebook I will get the message "cookies required". Yet, I can run my little test app to my hearts content and it will log me in, expire after 20 seconds (which would force me to log back in once I click a link), etc. No loss of functionality, it works.

1. When I first run the app with cookies disabled:

2. Then, I log-in using my so@test.com user (type any password):

... And I can navigate to any view I want.

So what am I missing here? Does cookie auth mean something different than the cookies associated with your browser? Or this is some type of server cookie (vs a client cookie or something)? Or does ASP.NET Core figure out a way around that in some way?

********** NEW INFORMATION **********

Looks like I should have tried another browser other than IE. Firefox and Chrome did as expected, whereas IE and Edge ignores the fact that I have its cookies blocked. Does anyone know why? Is this some special magic for Microsoft browsers that other browsers don't have/get?