public SSOToken Login(string username, string password)
{ // default response
SSOToken token = new SSOToken
{ Token = string.Empty,
Status = "DENIED"
};
// authenticate user
if (string.CompareOrdinal("foo", username) == 0 && string.CompareOrdinal("bar", password) == 0) { // mock data to simulate passing around additional data
Guid temp = Guid.NewGuid();
// manage cookie lifetime
DateTime issueDate = DateTime.Now;
DateTime expireDate = issueDate.AddMonths(1);
// create the ticket and protect it
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, username, issueDate, expireDate, true, temp.ToString());
string protectedTicket = FormsAuthentication.Encrypt(ticket);
// save the protected ticket with a cookie
HttpCookie authorizationCookie = new HttpCookie(FormsAuthentication.FormsCookieName, protectedTicket);
authorizationCookie.Expires = expireDate;
// protect the cookie from session hijacking
authorizationCookie.HttpOnly = true;
// write the cookie to the response stream
HttpContext.Current.Response.Cookies.Add(authorizationCookie);
// update the response to indicate success
token.Status = "SUCCESS";
token.Token = protectedTicket;
}
return token;
}