How to authenticate on ASP.NET

Question

I'm developing an ASP.NET app (c#) that need to authenticate users. To do that I have a SQL Server database with the users of this application.

Which is the best way to do that?

I've been reading this:

How to: Implement Simple Forms Authentication

In the example I will to replace this code:

<script runat="server">
  void Logon_Click(object sender, EventArgs e)
  {
    if ((UserEmail.Text == "[email protected]") && 
            (UserPass.Text == "37Yj*99Ps"))
      {
          FormsAuthentication.RedirectFromLoginPage 
             (UserEmail.Text, Persist.Checked);
      }
      else
      {
          Msg.Text = "Invalid credentials. Please try again.";
      }
  }
</script>

With my ADO.NET Entity code to search the user on the database. It will work?

Another way is Membership ([http://msdn.microsoft.com/en-us/library/tw292whz.aspx][2]) but I think it is the hardest way.

Or maybe I can use Windows Live ID but I don't know how to connect Live ID with my users table.

Thank you!

ppiotrowicz · Accepted Answer · 2009-05-15 16:07:09Z

6

Membership is the easiest way to provide authentication IMO. If you're interested in using it I recommend this tutorial by Scott Mitchell:

answered May 15, 2009 at 16:07

ppiotrowicz

4,6343 gold badges34 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Greg B Over a year ago

Absolutely. Membership is there to take the hassle out of this process.

Josh E Over a year ago

As stated in other answers, rule #1 is never write your own auth mechanism. The built-in Membership, Roles, and Profile providers work very well and are easy to use. The link ppiotrowicz provided, and the other 4guys tutorials are really very good at conveying the concepts and execution of how to do it.

AminM · Accepted Answer · 2014-02-04 11:39:09Z

3

One of the most important security rules (#7 on the OWASP top 10) is NOT to write your own authentication mechanism when there are tried and tested mechanisms available. ASP.Net Authentication is simple to use, and tried and tested, and you are setting yourself up for all kinds of pain if you proceed down the path of writing your own mechanism.

Top 10 2007-Broken Authentication and Session Management

edited Feb 4, 2014 at 11:39

AminM

1,8464 gold badges34 silver badges51 bronze badges

answered May 15, 2009 at 16:07

David

73.7k19 gold badges134 silver badges177 bronze badges

Comments

d4nt · Accepted Answer · 2009-05-15 16:08:31Z

2

Both approaches will work but the recommended way would be to implement you're own Membership provider for two reasons:

The built in .NET authentication mechanisms are likely to be more robust than yours
It enables you to connect some of the standard .NET controls to your custom user database.

This page has instructions on how to implement your own Membership provider

answered May 15, 2009 at 16:08

d4nt

15.8k9 gold badges46 silver badges52 bronze badges

2 Comments

VansFannel Over a year ago

Do you have any example? I don't know how to do it.

Zhaph - Ben Duguid Over a year ago

If you've got your database of users already configured and full of user details, then writting a provider using the examples linked to would be the simplest option, followed by porting your user details to the standard ASP.NET SQL format.

Collectives™ on Stack Overflow

How to authenticate on ASP.NET

3 Answers 3

2 Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related