Best way to handle Login / Authentication in mvc3

Question

Just wondering what the best practice for handling login/user authentication in mvc3 would be. Better to use the built-in membership such as:

    [HttpPost]
    public ActionResult Register(RegisterUser model)
    {
        if (ModelState.IsValid)
        {
            // Attempt to register the user
            MembershipCreateStatus createStatus;
            Membership.CreateUser(model.UserName, model.Password, model.Email, null, null, true, null, out createStatus);

            if (createStatus == MembershipCreateStatus.Success)
            {
                FormsAuthentication.SetAuthCookie(model.UserName, false /* createPersistentCookie */);
                return RedirectToAction("Index","User");
            }
            else
            {
                ModelState.AddModelError("", ErrorCodeToString(createStatus));
            }
        }

        return View(model);
    }

or something more simple and custom such as making your own cookie to avoid having to use the pre-packaged database structure each time?

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
    1,
    user.UserName,
    DateTime.Now,
    DateTime.Now.AddMinutes(10),
    false,
    null);

string encryptedTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);

this.Response.Cookies.Add(cookie);

Community · Accepted Answer · 2017-05-23 10:34:48Z

3

Personally I agree with the approach taken by Stack Overflow in providing two ways to register directly via Stack Exchange and OpenId / OAuth access; Google, Yahoo, Facebook, Twitter, etc.

When providing your own registration I would stick with either the ASP.NET Membership provider or a similar one made available via NuGet.

When using OpenId and OAuth I've had great success with DotNetOpenAuth. Refer to Andrew Arnott's detailed answer the benefits and justification for using OpenId: To OpenID or not to OpenID? Is it worth it?

edited May 23, 2017 at 10:34

CommunityBot

11 silver badge

answered Jun 14, 2012 at 4:03

Kane

16.8k11 gold badges67 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2020-06-20 09:12:55Z

2

The ASP.NET Membership exists for a reason.

If it was as simple as setting a cookie, LinkedIn hackers wouldn't have my password.

Do not write your own Membership provider unless you REALLY know what you're doing.

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Jun 14, 2012 at 3:57

Marko

72.3k29 gold badges126 silver badges160 bronze badges

Comments

StanK · Accepted Answer · 2012-06-14 05:05:58Z

1

I would suggest that your best option is to provider a custom provider, so that you don't have to use the 'pre-packaged' database. This way you can re-use the built-in authentication and authorization stuff, while still having a customised user database.

It is not that difficult, simply create a class deriving from MembershipProvider (and RoleProvider if you want to included roles). These are abstract classes, so you need to provide implementations of the various methods. To save having to provide implementations for all the methods, you can have methods you aren't going to use throw NotImplementedException.

answered Jun 14, 2012 at 5:05

StanK

4,7702 gold badges24 silver badges47 bronze badges

Collectives™ on Stack Overflow

Best way to handle Login / Authentication in mvc3

3 Answers 3

Comments

Do not write your own Membership provider unless you REALLY know what you're doing.

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Do not write your own Membership provider unless you REALLY know what you're doing.

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related