How to Authenticate in ASP.NET
I am developing an ASP.NET (C #) application that is needed to authenticate users. For this I have a SQL Server database with users of this application.
What's the best way to do this?
I read this:
How to Authenticate Simple Forms
For this example, I will replace this code:
<script runat="server">
void Logon_Click(object sender, EventArgs e)
{
if ((UserEmail.Text == "jchen@contoso.com") &&
(UserPass.Text == "37Yj*99Ps"))
{
FormsAuthentication.RedirectFromLoginPage
(UserEmail.Text, Persist.Checked);
}
else
{
Msg.Text = "Invalid credentials. Please try again.";
}
}
</script>
With my ADO.NET Entity code to find a user in a database. Will it work?
Another way is membership ([ http://msdn.microsoft.com/en-us/library/tw292whz.aspx] [[2 ] ), but I think this is the hardest way.
Or maybe I can use Windows Live ID, but I don't know how to connect Live ID to my users table.
Thanks!
a source to share
Membership is the easiest way to provide IMO authentication. If you are interested in using it, I recommend this tutorial by Scott Mitchell:
a source to share
One of the most important security rules (# 7 at the top 10 of OWASP) is NOT to create your own authentication mechanism with available and proven mechanisms. ASP.Net Authentication is easy to use, tested and tested, and you set yourself up for all sorts of pain if you go down the path of building your own mechanism.
a source to share
Both approaches will work, but the recommended way is to implement your own membership provider for two reasons:
- .NET built-in authentication mechanisms are likely to be more secure than yours.
- It allows you to connect some standard .NET controls to your custom database.
This page provides instructions on how to implement your own membership provider
a source to share