CODEWITHSUNDEEP
asp.netwebforms
Luke
Luke

Reputation: 344

is it good to use Session for storing a logged in user id? Or is there a simpler way?

We have a log-in form in ASP.Net Webforms. and when user logs in we save the user id to session state.

Session["CurrentUserId"] = user.Id;

So this is how we know a user is logged in.

if(Session["CurrentUserId"] == null) Redirect("Login.aspx");

This is all we use Session for. I am storing session in DynamoDB because we have many load balanced servers. But sometimes DynamoDB gets overloaded or gives errors. So I trying to get rid of session state to avoid these errors and to simplify a login process.

So what alternatives are there? How do modern websites log people in and remember they are logged in, and timeout after x minutes?

Is there a way to use a secure cookie to just do it? And how would you expire it if user doesnt do anything for 20 minutes? It has to work over a collection of web servers.

Upvotes: 0

Views: 1335

Answers (2)

Albert D. Kallal
Albert D. Kallal

Reputation: 49059

if you using the standard FBA login providers?

You can get user logon ID with this:

 Membership.GetUser.ProviderUserKey

And you can get user email with this:

 Membership.GetUser.Email

So, the user logon id can be fetched with above.

As for session() being a bottle neck?

Well, it not all that bad - you not "updating" the session() value by doing this, so it certainly does not have to be written back each time (for a post) and also it means that a lock on session() during post backs etc. should not occur.

I would however consider one of the above two approaches, since then session() re-sets or anything else would not matter to get the user ID, or email.

As noted, this much depends on what security and authentication provider you are using here.

Upvotes: 0

John Wu
John Wu

Reputation: 52260

Storing user ID in session is not necessarily bad but has to be combined with other things in order to secure the site against things like session fixation attack and CSRF (also known as "session riding"). It is also problematic in a web farm if you are using in-proc session state.

In ASP.NET web forms, the standard way to authenticate is to use forms authentication, which places an encrypted cookie ("authentication ticket") on the browser. You may also want to put the user ID somewhere in session and compare it to the authentication ticket in order to ensure they match.

Upvotes: 0

Related Questions