Skip to content

Web login and cookie issuance

clsSAIFLoginInfo.Login() is the operation an interactive web sign-in page ultimately calls. It wraps explicit-credential authentication for a web-scoped principal, and — only when that authentication succeeds — writes both a custom, DPAPI-encrypted SAIFAUTH cookie and the standard ASP.NET Forms authentication cookie, so that later requests can be recognized without asking the user to log in again.

Field Value
Operation ID OP-008
Trigger Caller invokes clsSAIFLoginInfo.Login()
Inputs User ID, password, optional domain, current HTTP context
Outputs Boolean login result plus SAIFAUTH and Forms authentication cookies on success
Primary components clsSAIFLoginInfo.Login, clsSecurityPrincipal.Authenticate, DPAPI.Encrypt
Entry point SAIF.Framework.Security\clsSAIFLoginInfo.vb

Steps

  1. Login() constructs a web-scoped clsSecurityPrincipal and assigns UserName, Password, and optional Domain to it. Because those property setters always call Logout() first, any prior principal state is cleared before the new login attempt begins — enforcing BR-006.
  2. The helper calls SecurityPrincipal.Authenticate(), delegating to the same explicit-credential NTLM authentication used elsewhere in the library.
  3. If authentication fails: Login() returns False immediately, and no cookies are written.
  4. On success, the helper concatenates UserID, a tab separator, and the clear-text password into a single payload, encrypts it with DPAPI.Encrypt(MachineKey, credentials, HttpContext.Current.Request.UserHostAddress, "") — using the requesting host address as additional entropy — and stores the encrypted result in the SAIFAUTH cookie.
  5. The helper then issues FormsAuthentication.SetAuthCookie("user@domain", False), giving later requests a standard Forms ticket that principal initialization can rehydrate through its Forms-identity branch.
  6. Login() returns True to signal a completed, cookie-backed login.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Login requested]) --> Principal[Create web principal]
    Principal --> Auth[Authenticate credentials]
    Auth --> Success{Authenticated?}
    Success -->|No| EndErr([Return False])
    Success -->|Yes| Cookie1[Write SAIFAUTH cookie]
    Cookie1 --> Cookie2[Write Forms auth cookie]
    Cookie2 --> EndOk([Return True])

Failure and edge-case behavior

  • A failed authentication attempt prevents both cookies from being issued — there is no partial cookie state.
  • The encrypted SAIFAUTH payload uses the requesting host's address as additional DPAPI entropy, tying the encrypted credential to the originating client.
  • The helper requires an active HTTP context to create cookies; it is a web-only operation.

Sources

  • SAIF.Framework.Security\clsSAIFLoginInfo.vb
  • SAIF.Framework.Security\clsSecurityPrincipal.vb
  • SAIF.Framework.Security\DAPIEncrypt.vb