title: FormsAuthentication ASPXAUTH Cookie WCF and JSON
body: <p>I have a WCF web service that expose functions to get X informations. The service return the informations in JSON format. <strong>What I need to do if I want to secure this web service? Not using default IIS security, I want to use custom login (with database verification).</strong></p>
  
  <p>The client application from where I want to show the X informations make JQUERY and AJAX calls. First, I have a login page where I can enter user name and password (encrypted in MD5). The client call the service with these informations and the service return YES if the user is valid (simple select on a postgresql database) or false. For the moment, I initiate a FormsAuthentication object and add it to the cookie.</p>
  
  <pre><code>Private Function SetAuthCookie(name As String, rememberMe As Boolean, userData As String) As Integer
  
      ' In order to pickup the settings from config, we create a default cookie and use its values to create a new one.
      Dim cookie As HttpCookie = FormsAuthentication.GetAuthCookie(name, rememberMe)
      Dim ticket As FormsAuthenticationTicket = FormsAuthentication.Decrypt(cookie.Value)
  
      Dim newTicket As New FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, userData, ticket.CookiePath)
      Dim encTicket As String = FormsAuthentication.Encrypt(newTicket)
  
      ' Use existing cookie. Could create new one but would have to copy settings over...
      cookie.Value = encTicket
  
      HttpContext.Current.Response.Cookies.Add(cookie)
  
      Return encTicket.Length
  End Function
  </code></pre>
  
  <p>Secondly, I see that when I do calls from the client code, the .ASPXAUTH cookie is passed for each calls. <strong>But, what I need to do on the server side to validate that this is a good user</strong> and not a "stolen" cookie ASPXAUTH code? I don't think that this little isValidUser function is enough to valid the call.</p>
  
  <pre><code>Private Function isValidUser() As Boolean
      Dim cookie As HttpCookie = HttpContext.Current.Request.Cookies(FormsAuthentication.FormsCookieName)
  
      If cookie Is Nothing Then Return False
  
      Dim decrypted = FormsAuthentication.Decrypt(cookie.Value)
  
      If String.IsNullOrEmpty(decrypted.UserData) Then Return False
  
      Return True
  End Function
  </code></pre>
  
  <p>Best regards,</p>