CODEWITHSUNDEEP
c#asp.net
Chris
Chris

Reputation: 371

Quickest way to require authentication in asp.net webform?

As of right now, I have the user register/log in and then if successful, redirect them to the homepage. However, this is extremely artificial as the user can simply type the url and go to any page they want. I'm fairly new to this and I've heard forms authentication mentioned multiple times as a way to do what I need: a simple means to prevent a user from accessing any page and once they haven't done a "Request" in awhile, I want them to be "logged out" and sent back to the log in page. I guess, in the end, I have three questions:

1) Can someone provide me a link to a great tutorial on authentication? I don't want to get too far in depth if I can avoid it.

2) Also, is it recommended to use cookies for this or not? I've heard different views on this?

3) I was told I can set this up in the web.config as well as in code behind? Is this true? If so, which do you recommend?

Thank you very much and I apologize for the broad question(s). If you need any more information, please let me know.

Upvotes: 2

Views: 11833

Answers (4)

Dmitry Shkuropatsky
Dmitry Shkuropatsky

Reputation: 3975

Check How to: Implement Simple Forms Authentication.

This type of authentication requires a log-in form referenced in web.config. It can be done with or without cookie: Cookieless Forms Authentication.

Upvotes: 0

Rich
Rich

Reputation: 1915

Here is Walkthrough: Creating a Website with Membership and User Logon that you can use.

As far as using cookies is concerned, they can be exploited. To be safe, its best not to put anything of value in them. If you have to, then you should secure them (another topic all together). In the scope of your question, know that ASP.NET encodes and hashes its authorization ticket so you are ok using the default cookie settings. More info on the Web.config form element attributes here.

Forms Authentication is setup in the Web.config file. You can set the slidingExpiration attribute to log a user out if they haven't made a request with in the time set in the attribute.

Upvotes: 1

tbt
tbt

Reputation: 748

You can use the builtin asp.net sql membershiprovider and login controls for register and login this is implemented in the default web application project. Then you can check the value of Request.IsAuthenticated in page load and redirect to login page with Response.Redirect(loginPageUrl)

1) http://www.asp.net/web-forms/overview/security good place to start.

2) If you are using the ASP.NET builtin authentication in most scenarios you dont have to worry about cookies. IMO nothing wrong with cookies :)

3) Usually you have to set this up in both. Generally you configure the auth method and the providers in web.config and do the redirection to login page in the codebehind or globally in global.asax.cs

Hope this helps.

Upvotes: 0

Nick Bray
Nick Bray

Reputation: 1963

Take a look at this MSDN tutorial:

http://msdn.microsoft.com/en-us/library/ie/xdt4thhy.aspx

Upvotes: 0

Related Questions