asp.net MVC FormsAuthentication for claim based authentication

Question

We are using Gigya to authenticate the user which will provide us with user Id and email. Then we pass the user detail to our CRM Web Service which will return the user data from CRM.

We then need to create a session for the user so that we can identify whether the user is logged in or not. If not logged in then redirect to Gigya for login/register etc.

Now, given that we are not using any ASP.NET Membership or similar, I'm thinking how we are going to secure the member pages. One way I can think of is store the user detail in session. Then check if user detail exists in session, if doesn't exist prompt for login.

I'm also thinking whether:

I can use FormsAuthentication.SetAuthCookie or similar to create a asp.net session
Or is there better way to achieve this.

Also, if I use FormsAuthentication.Logout will it clear all my session and cookies even though I'm not using asp.net membership provider?

Goal:

To be able to create a session for the user
Able to authorize user based on user role which we get from CRM.
Able to logout the user on Lout button click.

Erik Funkenbusch · Accepted Answer · 2015-03-21 16:01:45Z

1

First, and this is very very very important from a security perspective.

Authentication != Session.

They are different concepts. Second,

NEVER USE SESSION for AUTHENTICATION

see first rule. FormsAuthentication has nothing. Zero. Zilch. Nada. To do with session management. Nor does it have anything to do with Membership or credential verification. All it does is store a cookie that ASP.NET can decode to verify that the user is authenticated or nor. This cookie is set by your application when it has validated the users credentials.

FormsAuthentication.Logout() does not clear sessions, because as I already said, they have nothing to do with each other. You have to clear the session by calling Session.Abandon().

Session is about storing data for a user, and is not secure. Session is volatile, and IIS can discard it whenever it feels like, for any reason, at any time. You cannot depend on Session to be there from request to the next.

Authentication is encrypted, and strictly about proving the user has been authenticated.

Authentication can transcend sessions. It can be good for hours, weeks, months... Your session is only good for the time you are currently there (if IIS doesn't kill it earlier).

answered Mar 21, 2015 at 16:01

Erik Funkenbusch

93.7k29 gold badges201 silver badges292 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Nil Pun Over a year ago

Given that our users are already authenticated using Gigya, are you saying that we don't need to use any of the FormAuthentcation functions? If session is not the right approach to track logged in users then what's the alternative?

Erik Funkenbusch Over a year ago

@Myagdi - I don't know anything about Gigya, so I don't know if they provide some mechanism of doing this or not. But I suggest you re-read what I wrote.

Collectives™ on Stack Overflow

asp.net MVC FormsAuthentication for claim based authentication

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related