Access ASP.NET authentication ticket on Client (via javascript)
asp.net, forms-authentication, javascript
Solution
The reason it's blank is because the cookie is protected by being marked as HttpOnly. This means it cannot be accessed via script. Turning this off is a very very bad idea, as XSS vulnerabilities in your site could expose it to cookie theft, so I'm not going to tell you how you can do it.
Problem
I have an ASP.NET website that uses Forms authentication ``` <authentication mode="Forms"> <forms name="NewsCoreAuthentication" loginUrl="~/Default.aspx" defaultUrl="~/Default.aspx" protection="Validation" timeout="300" domain="someRootDomain.com" /> </authentication> ``` I need to identify if user is authenticated on web page after it was rendered to client. To accomplish this I thought that I can read document.cookie and check if ".ASPXAUTH" is there. But the problem is that even if I am signed in this value is empty. How can I check that user is authenticated? Why document.cookie is empty? Thank you for answers. blowdart helped me to understand why authentication ticket is not accessible from client script.