Authentication in ASP.NET using FormsAuthentication

Question

I am using FormsAuthentication and ASP.NET Memberships and Roles in my ASP.NET project. I have some aspx files which can be viewed / accessed by only authenticated users. I think I can do this using one of the following two ways.

Configuring the web.config file. Allow users with roles 'admin' and 'members' to access those apsx files, and deny all other anonymous users.
In page_load events of those apsx files, just checking whether the curent user is authenticated or not using HttpContext.Current.User.Identity.IsAuthenticated

I am wondering whether these two approaches are equivalent or not for apsx files.

Anders Abel · Accepted Answer · 2012-07-31 17:38:19Z

1

They are not equivalent. Method 1. gives access only to the "admin" and "members" roles. If you add another role, they won't have access. Method 2 lets any signed in user access the data.

I think that the preferred way is to organize the aspx files in directories depending on what roles should access them. Then configure access on the directories in web.config.

answered Jul 31, 2012 at 17:38

Anders Abel

69.6k18 gold badges154 silver badges221 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Hello World Over a year ago

For method 2, I can check whether the user has the role 'admin' or 'members' using HttpContext.Current.User.IsInRole. Now is it equivalent to Method 1?

Anders Abel Over a year ago

Yes, checking HttpContext.Current.User.IsInRole would make those methods equivalent.

Wiktor Zychla · Accepted Answer · 2012-07-31 17:47:08Z

1

As others mention, this is not equivalent. However, even if you modify "2." to check roles, this is worse approach as you introduce a custom code to handle something which can easily be handled in a standard way.

Consider also yet another approach, where you create a separate folder, put your restricted pages there and create an auxiliary web.config to contain:

...
<system.web>
   <authorization>   
       <allow roles="admin,members" />
       <deny users="*" />
   </authorization>   
</system.web>

This way you require authorization to all resources in the folder, pages, styles, images.

answered Jul 31, 2012 at 17:47

Wiktor Zychla

48.5k6 gold badges83 silver badges114 bronze badges

Comments

Aghilas Yakoub · Accepted Answer · 2012-07-31 17:38:34Z

Hello you must distinct between Authentification and Authorization

"HttpContext.Current.User.Identity.IsAuthenticated" is : Authentification
"Allow users with roles 'admin' and 'members'" is : authorization, after authentification we execute authorization

You can read this article : http://www.duke.edu/~rob/kerberos/authvauth.html

Authentication is the mechanism whereby systems may securely identify their users. Authentication systems provide an answers to the questions:

Who is the user?
Is the user really who he/she represents himself to be?

Authorization systems provide answers to the questions:

Is user X authorized to access resource R?
Is user X authorized to perform operation P?
Is user X authorized to perform operation P on resource R?

Collectives™ on Stack Overflow

Authentication in ASP.NET using FormsAuthentication

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related