CODEWITHSUNDEEP
c#asp.netsql-server
Kirkland
Kirkland

Reputation: 843

ASP.NET SQL Server Database Authentication

I'm about to start working on an ASP.NET (C#) website project which requires users to authenticate and I've run into a bit of a design issue. I am required to use a SQL Server database to store the web app's data (to include user's login data), but all of the information I've found regarding ASP.NET and authentication uses Windows Authentication.

Now of course I could just write the code to query the database and check the users input against the database to see if the username/password exists (the current plan), but then how do I set the state of the session to authenticated along with other data (such as a user ID) so that the site can give the user only their data?

Upvotes: 0

Views: 1083

Answers (1)

Wiktor Zychla
Wiktor Zychla

Reputation: 48314

First, read more on Forms Authentication. You couldn't have really missed that (could you?) but it's the other major authentication mechanism that doesn't involve Windows accounts, instead the session is maintained with the help of a cookie that stores the user name together with any other so called user data (could be user ID or whatever else).

Second, the Membership/Role Provider mechanism is available for like 10 years - and it gives you an abstraction you implement on your own. The abstraction is about storing users/passwords/roles. The Membership/Role Provider is nowadays slowly replaced with the Identity 2.0 framework and you are free to choose the olderone or try the newer.

These two together, Forms Authentication and Membership/Role Provider, make a foundation of what you need.

The basic flow is as follows:

  1. users request various resources ("pages")
  2. some resources are guarded from anonymous access and require authentication/authorization
  3. the Forms Authentication module redirects requests to such resources to a login page (login view)
  4. in the login page you use the Membership/Role Provider to verify user and issue a Forms cookie
  5. you redirect back

The Forms authentication module now picks the cookie upon every request and recreates the identity so that the user is authenticated when your server code is about to run.

Upvotes: 3

Related Questions