Safe authentication with ASP.net

Question

Am failry new to authentication logic, would anyone be able to tell me if I am missing something here as it seems a little too good to be true. I validate users using something like this;

        if (validateUser(form.Email, form.Password))
        {
            return signIn(form.Email);
        }

the validateUser function returns a boolean value. Sign in then does something like this;

    public void signIn(string email)
    {
        FormsAuthentication.SetAuthCookie(nameOfUser, false);
    }

Which will subsequently allow me to do things like this for all future requests;

string userEmail = User.Identity.Name;
Profile p = Profile.getProfileFor(userEmail);

This seems a little too simple to be safe! Is there anything I'm missing here / any blindingly obvious security risks? Or is this basically how it's done?

Regards,

Mike

What makes you think that it is not safe?

Matthew Abbott
– Matthew Abbott

2012-03-12 10:12:07 +00:00
Commented Mar 12, 2012 at 10:12 — Matthew Abbott
– Matthew Abbott, Commented Mar 12, 2012 at 10:12

Stilgar · Accepted Answer · 2012-03-12 13:24:24Z

2

There is so much more you can do with security:

Encrypt the password
Log every login attempt with IP address to identify attacks
Use an integer identity column instead of email:

This will make the app leaner and faster.

If you use a number instead of email a hacker would have a harder time associating the information(user) to hack. You can learn so much from a user just by having his email

.

Cache the identity
Use roles

edited Mar 12, 2012 at 13:24

Stilgar

23.8k16 gold badges68 silver badges108 bronze badges

answered Mar 12, 2012 at 13:01

Internet Engineer

2,54410 gold badges41 silver badges54 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Stilgar · Accepted Answer · 2012-03-12 12:57:21Z

2

In theory you should use HTTPS to avoid man in the middle attacks but this is not something done in code. Also it is not obvious from your code if you are hashing the passwords as you should be.

BTW the .NET convention is to use PascalCase for method names.

answered Mar 12, 2012 at 12:57

Stilgar

23.8k16 gold badges68 silver badges108 bronze badges

Comments

Mike Guthrie · Accepted Answer · 2012-03-12 12:49:25Z

1

That is how it is done, correct.

The only security risk to note is the same as with all form posts, in that all values entered by the end-user into the browser are sent back to the server in plain text, including the password. So, this exposes the possibility of someone trying to sniff the traffic for passwords, for which you can use https to get around that problem.

answered Mar 12, 2012 at 12:49

Mike Guthrie

4,0592 gold badges27 silver badges48 bronze badges

Collectives™ on Stack Overflow

Safe authentication with ASP.net

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related