Security .NET MVC C#, FormsAuthentication

Question

I am building one of my first MVC projects. Now I have come to the stage where I am developing the login!

I never used FormsAuthentication, and I am new to this.. But how "stupid"/insecure is it to do this if the user is valid:

 FormsAuthentication.Initialize();
 FormsAuthentication.SetAuthCookie("NameOnCookie", false);

And then I do this, in the top of my controller:

[Authorize(Users = "NameOnCookie")]

Is it dumb, or is it a secure way to work?! If it is a wrong way to work, give me directions!

And if its insecure why? How can you crack it?

Thanks!

NameOnCoockie Just a name I set if the User is Valid or not, thats the thought..... — Andreas Gustafsson
– Andreas Gustafsson, Commented Dec 8, 2011 at 23:26

Jacob · Accepted Answer · 2011-12-08 23:29:26Z

1

The Users property of AuthorizeAttribute specifies which users are allowed to call your action, so if you're specifically wanting a user with the exact username "NameOnCookie" to be authorized, your solution will work (assuming that you only called SetAuthCookie after a proper authentication took place).

answered Dec 8, 2011 at 23:29

Jacob

79k24 gold badges159 silver badges245 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Security .NET MVC C#, FormsAuthentication

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related