CODEWITHSUNDEEP
asp.net-mvc
Drew
Drew

Reputation: 3234

Where is a users data stored in the account system that comes with asp.net mvc framework?

On the first run of my mvc "hello world", i get a couple of buttons; home, about and log on. If I create a user account on the log on, where is the data stored? Is it secure enough to just leave it as is when the time comes to develop my application or should this be going to a database (if it isn't already)?

Thanks for your time.

Upvotes: 9

Views: 13478

Answers (5)

ChuckZ
ChuckZ

Reputation: 41

I'm taking the answer to the next logical step: OK, so I know it is in ASPNETDB.MDF, so how can I browse the table? (at least it was my next logical question)

Here is a good link: http://learningsqlserver.wordpress.com/2011/02/13/how-can-i-open-mdf-and-ldf-files-in-sql-server-attach-tutorial-troublshooting/

Essentially:

  • Run SQL Server Management Studio (menu shortcut under "Microsoft SQL Server ####")
  • Connect Object Explorer to your SQLEXPRESS server
  • Right-click on Databases and choose Attach...
  • Browse to your MDF file

Upvotes: 4

joshperry
joshperry

Reputation: 42227

ASP.Net MVC and WebForms share many of the same components including membership storage, authentication, authorization. These components are used on thousands of public sites around the internet.

Membership

The default ASP.Net MVC template uses the same SqlMembershipProvider as WebForms to store membership information. If you look in the web.config file you'll see the configuration section under the <membership/> element, it'll look like this;

<membership>
  <providers>
    <clear/>
    <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices"
         enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false"
         maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
         applicationName="/" />
  </providers>
</membership>

It references the connection string named ApplicationServices which you'll find defined at the top of the config file:

  <connectionStrings>
    <add name="ApplicationServices"
         connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true"
         providerName="System.Data.SqlClient" />
  </connectionStrings>

This mounts the aspnet.mdf file found in your application's App_Data directory using a locally installed instance of Microsoft Sql Server Express.

You can easily upsize this to full SQL Server by copying the MDB file to your SQL Server, mounting it, and updating the connection string.

Authentication

Authentication is again handled by the same FormsAuthentication class used for WebForms, it is also configured in the web config file:

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>

Authorization

The default template also has configuration entries for SqlRoleProvider, and WindowsTokenRoleProvider which can be used to store and retrieve roles for your users from the database or ActiveDirectory respectively. Role managers are configured in the <roleManager/> element.

<roleManager enabled="false">
  <providers>
    <clear/>
    <add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="ApplicationServices" applicationName="/" />
    <add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" />
  </providers>
</roleManager>

Roles are by default disabled, you can enable support for roles by changing the enabled attribute of the roleManager element from false to true.

Once you have roles configured, you can use ASP.Net authorization elements to control access to resources on your site. You can also use Authorize attributes on your controllers and/or actions for more finely grained access control. You don't have to use roles for authorization, usernames work just fine, but doing so will make management of authorization much easier.

Security

All of these modules are written using industry accepted security best practices. Authentication is handled by IIS, which can use Digest or Windows Integrated auth, both secure methods; because of browser support, anything you wrote yourself would be restricted to these methods as well.

The passwords are stored hashed in the database with a salt making brute-force attacks with methods such as rainbow tables much more difficult. The providers also support password complexity, and expiration out-of-the-box.

The authentication tokens are securely encrypted with a machine specific key and signed with a MAC to ensure that they haven't been tampered with, only then are they stored in a client-side cookie.

Testability

Even though the security is quite standard, one emphasis that MVC proponents encourage which these components don't make simple, is testing. This issue however can be worked around fairly simply with some strategically placed interfaces, a couple facade classes, and some dependency injection (which is supported by default in MVC3 now).

Upvotes: 16

tugberk
tugberk

Reputation: 58444

the database is created aoutomatically by asp.net. this feature uses asp.net build in membership feature. you shoul look at it firstly : http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx

and also look at the models folder, you will see the account model there. and look at the controller folder. there, you will accountcontroller. review the code and you will figure it out.

Upvotes: 0

goenning
goenning

Reputation: 6654

Yes, it's stored in a database. The database is in the App_Code folder under the name of ASPNETDB.MDF. You can configure it at your web.config file.

Is it secure? Well, IMHO, it is. But I really don't like this approach, I prefer to design my own authentication service and have full control over it. If you're going to stick with this method, you should read more about ASP.NET Membership Provider with Forms Authentication.

Upvotes: 4

3Dave
3Dave

Reputation: 29051

If you create a default ASP.NET MVC 3 app and look int the the web.config, you'll see:

<add name="ApplicationServices"
     connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true"
     providerName="System.Data.SqlClient" />

And

<membership>
  <providers>
    <clear/>
    <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices"
         enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false"
         maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
         applicationName="/" />
  </providers>
</membership>

This appears to attempt to connect to a local SQL Server Express instance and load aspnetdb.mdf from the app data folder. The membership.providers key then references System.Web.Security.SqlMembershipProvider, and references the ApplicationServices connection.

Upvotes: 1

Related Questions