CODEWITHSUNDEEP
c#asp.netasp.net-mvc
user5648283
user5648283

Reputation: 6203

How in ASP.NET MVC do I maintain info about whether a user is "logged in" throughout pages?

After they type in their password, should I keep a variable in server session storage like Session["loggedIn"] = true that I check when requests are made to pages that require a login, or is there a better/safer way this is traditionally done in ASP.NET?

Upvotes: 1

Views: 1149

Answers (2)

Kostas Dafnomilis
Kostas Dafnomilis

Reputation: 629

The way that this is traditionally done in ASP.NET and by my opinion also better and safer is by making use of the ASP.NET Identity package.

ASP.NET Identity handles all aspects around user accounts in a web application:

  • database for users, including roles and more
  • user registration and management, like register, email verification, log in, remember me option, forgot my password action and more.
  • user authentication & authorization

Just to make things more clear, authentication means that the user making the request is actually a valid application user and authorization means that the user has the authority to perform the requested action.

Practically, when a user logs in, Identity automatically keeps that information and makes it available in all controllers and views under User property. So you know at any time which user made the request. Identity also supplies each request with a cookie used for user authentication and authorization.

To check for user authentication you use the User.Identity.IsAuthenticated in a view and the Authorize attribute in a controller:

[Authorize]
public ActionResult Create( ... ){ ... }

The above use of the Authorize attribute will allow only to registered users to request this page.

It is also very common to extend the functionality of your application to include roles for the users and user authorization. Identity creates a "Users" table, a "Roles" table and a many to many relationship between them. After assigning roles to your users you can authorize their requests by using User.Identity.IsInRole("YourRoleName") in a view and in a controller:

[Authorize("YourRoleName")]
public ActionResult Create( ... ){ ... }

The above use of the Authorize attribute will allow only to registered users having the "YourRoleName" role to request this page. In any case if Identity fails to authenticate or authorize the request will prompt to the log in page.

ASP.NET Identity is simple to use, it works and it is easy to extend the membership functionality of your application both by making use the many tools supplied with it and overriding its classes to give them a more specific or complex behaviour.

You will find infinite help on the web on how to use it or a step by step guide.

Upvotes: 2

danludwig
danludwig

Reputation: 47375

No, do not keep this in a session variable. In fact, I would argue you should try not to use session for anything. Try to keep the HTTP communication as stateless as possible.

For authentication in ASP.NET MVC, you have 2 alternatives, but ultimately, the both end up working the same way: by writing an encrypted authentication cookie to the browser after you successfully log a user in.

The newer alternative was mentioned in a comment to the OP: Microsoft.AspNet.Identity. To use this, you should be using a newer version of ASP.NET MVC with the OWIN pipeline (though I am not sure if you have to). The older alternative is called Forms Authentication, and can be used with any version of MVC except version 6 (the new vNext / core 1.0 stuff) I believe.

When you have successfully integrated one of these 2 tools into your MVC application, after a user logs on, your Controllers will have a non-null User property of type IPrincipal. You can use this property to determine whether or not a user is authenticated:

// in a controller
bool isThereAUserLoggedIn = this.User != null && this.User.Identity.IsAuthenticated;

If you are using the newer Microsoft.AspNet.Identity, then this IPrincipal User property will be implemented as a ClaimsPrincipal with one or more ClaimsIdentitys. Forms Authentication does not do claims like this, so if you want claims, or social login, etc, use Microsoft.AspNet.Identity.

Upvotes: 3

Related Questions