ASP. NET Forms authentication control flow

Browser and HTTP operations	Server reply
The slave server requests protected resources. The HTTP operation is: GET/default. aspx	If no authentication Cookie exists, redirect the request to the logon page to collect creden. Use RETURNURL as the keyword and place the information about the start page in the query string. The server's HTTP response is: 302 Found Location: http://samples.microsoft.com/logon.aspx? RETURNURL =/default. aspx
Redirect to the logon page. The HTTP operation is: GET/logon. aspx? RETURNURL =/default. aspx	Return to the logon page. For security, we recommend that you use Secure Sockets Layer (SSL) for the logon page to prevent user creden。 from being sent in plaintext. The server's HTTP response is: 200 OK
After you enter the creden。 on the logon page, submit the page. The HTTP operation is: POST/logon. aspx? RETURNURL =/default. aspx	Verify user creden. If the creden。 pass authentication, redirect the browser to the original URL specified as the RETURNURL variable in QueryString. By default, authentication tickets are issued as cookies. Note: You can use the CookieMode attribute to specify that the authentication ticket is included in the URL, rather than in the Cookie. The server's HTTP response is: 302 Found Location:/default. aspx
Follow the redirection operation and request the original resource again. The HTTP operation is: GET/default. aspx	If the user passes authentication, access is allowed and an authentication Cookie is granted. This Cookie contains an authentication ticket. Future requests of the same browser session will be authenticated when the Module checks the Cookie. You can create a persistent Cookie that can be used for future sessions. However, the validity period of the Cookie ends until the expiration date. The server's HTTP response is: 200 OK Set-Cookie: ASPXTICKET = ABCDEFG12345; Path =/ Note: The Cookie Path is set /. Because Cookie names are case sensitive, this helps prevent URL inconsistencies in the site. For example, if the path is set to/SavingsPlan and the Link contains/savingsplan, the user is forced to re-authenticate because the browser does not send cookies.