How to create user authentication in .NET web application?

Question

I am creating ASP.NET MVC web application. I have data model User:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;

namespace Knihovna.Models
{
    public class User
    {
        public int UserId { get; set; }
        public string Name { get; set; }
        public string Login { get; set; }
        public string Password { get; set; }
        public List<Book> Books { get; set; }
    }
}

and I need to create user registration and user login. Application needs to know If user is logged in.

Is there some best practises how to do it? Save logged in user in session?

nerdybeardo · Accepted Answer · 2013-01-01 21:32:57Z

I would use the ASP.NET membership and role provider model. If you would like to do it with your custom tables you can create a class that inherits from Membership Provider. There are a number of methods you can implement to support things like changing passwords, forgot password etc... but the one for logging in would be ValidateUser

public sealed class MyMembershipProvider : MembershipProvider
{
    public override bool ValidateUser(string username, string password)
    {
        bool isValid = false;
        // your authentication logic here
        var ticket = new FormsAuthenticationTicket(
                    1,
                    YOUR_USER_ID_HERE,
                    DateTime.Now,
                    DateTime.Now.AddMinutes(30),
                    false,
                    name,
                    FormsAuthentication.FormsCookiePath);

                var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(ticket));
                HttpContext.Current.Response.Cookies.Add(authCookie);

        return isValid;
    }
}

You will also need to create a role provider if you would like there to be different levels of users. To do so you will inherit from the RoleProvider class.

public sealed class MyRoleProvider : RoleProvider
{
   // Implement logic here
}

To authorize certain areas of your application you would use the Authorize attribute.

public class MyController : Controller
{
     [Authorize(Roles="Role1,Role2")]
     public ActionResult Index()
     {
         // Implement your code
     }
}

Finally there is some configuration in the web.config you have to do to get it to use your providers.

<authentication mode="Forms">
  <forms loginUrl="~/Login" timeout="2880"/>
</authentication>
<membership defaultProvider="MyMembershipProvider" userIsOnlineTimeWindow="20">
  <providers>
    <clear/>
    <add name="MyMembershipProvider" type="Your.NameSpace.MyMembershipProvider" enablePasswordRetrieval="false" enablePasswordReset="false" requiresQuestionAndAnswer="false" writeExceptionsToEventLog="false"/>
  </providers>
</membership>
<roleManager enabled="true" defaultProvider="MyRoleProvider" cacheRolesInCookie="true">
  <providers>
    <clear/>
    <add name="MyRoleProvider" type="Your.NameSpace.MyRoleProvider"/>
  </providers>
</roleManager>

You can find more information about the memberhsip and role providers on MSDN

I implemented custom membership provider at it works now as I except, thanks!

Leniel Maccaferri · Accepted Answer · 2013-01-01 23:16:53Z

2

There's no need to mess up with the Session object.

As you're already working with ASP.NET MVC, you probably have an AccountController in your Controllers folder. This controller has the basic authentication methods in place.

I suggest you take a look at this tutorial by the ASP.NET team that explains and then shows you how to use Authentication + Authorization in ASP.NET MVC.

The default Visual Studio project template for ASP.NET MVC automatically enables forms authentication when new ASP.NET MVC applications are created. It also automatically adds a pre-built account login page implementation to the project – which makes it really easy to integrate security within a site.

NerdDinner Step 9: Authentication and Authorization

answered Jan 1, 2013 at 23:16

Leniel Maccaferri

103k48 gold badges380 silver badges495 bronze badges

1 Comment

jnemecz Over a year ago

I need really very not complicated implementation of user login a register actions. Unfortunately it is school project so I need to program it myself. What do you suggest?

Collectives™ on Stack Overflow

How to create user authentication in .NET web application?

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related