title: Why is ASP.NET FormsAuthentication cookie not authenticating user?
body: <p>I have a site that uses the default SqlMembershipProvider and FormsAuthentication. I can use the built-in Login Controls and/or programmatically call all the methods to authenticate a user and get the same result - the user is authenticated and a cookie is created, but the cookie does not appear to be valid since I can't get into any page that requires authentication.</p>
  
  <p>There is no real code to show for the default Login Control since it should just "work", but here is the custom code I tried:</p>
  
  <pre><code>protected void ctrlLogin_Authenticate(object sender, AuthenticateEventArgs e)
  {
     if (Membership.ValidateUser(ctrlLogin.UserName, ctrlLogin.Password))
     {
        FormsAuthentication.RedirectFromLoginPage(ctrlLogin.UserName, ctrlLogin.RememberMeSet);
        /*
         * I also tried this:
        FormsAuthentication.SetAuthCookie(ctrlLogin.UserName, ctrlLogin.RememberMeSet);
        if (!String.IsNullOrEmpty(Request.QueryString["ReturnUrl"]))
           Response.Redirect(Request.QueryString["ReturnUrl"]);
        Response.Redirect("/index.aspx");
         */
     }
     else
     {
        ctrlLogin.FailureText = "Invalid Username/Password Combination";
     }
  }
  </code></pre>
  
  <p>With this code, <strong>Membership.ValidateUser() succeeds</strong>, and both <strong>FormsAuthentication.RedirectFromLoginPage() and FormsAuthentication.RedirectFromLoginPage() successfully set a cookie</strong> - that cookie just doesn't work to verify my authentication. I have confirmed this by deleting all my cookies and watching them get created again with FireCookie. The cookie name matches what I have in my web.config, the domain is "/", and the expiration date is as expected (see below).</p>
  
  <p>Here are the relevant sections of my web.config:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/login/index.aspx" name=".SoeAuth" protection="All"
      slidingExpiration="true" timeout="525599" domain=""&gt;&lt;/forms&gt;
  &lt;/authentication&gt;
  &lt;membership defaultProvider="SqlMembershipProvider"&gt;
    &lt;providers&gt;
      &lt;add connectionStringName="[MY_CS]" applicationName="[MY_APPNAME]"
        minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0"
        enablePasswordReset="true" passwordFormat="Hashed" requiresUniqueEmail="true"
        name="SqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider"
        requiresQuestionAndAnswer="false"/&gt;
    &lt;/providers&gt;
  &lt;/membership&gt;
  </code></pre>
  
  <p>It should be noted that I also added a machineKey entry in my web.config file based on a suggestion from <a href="https://stackoverflow.com/questions/3953212/why-isnt-aspaux-cookie-being-validated-by-formsauthentication">a very similar question here</a> (which didn't solve my problem). Also, for reference, the timeout=525599 above is 1 minute less than a year for my persistent cookies.</p>