Re: Authentication Security
From: Joe Fallon (jfallon1_at_nospamtwcny.rr.com)
Date: 11/07/04
- Next message: Prince: "DataGrid Key Field - Actual Value"
- Previous message: Ben: "Transfering web control data from one page to another"
- In reply to: David Kyle: "Authentication Security"
- Messages sorted by: [ date ] [ thread ]
Date: Sat, 6 Nov 2004 22:51:56 -0500
I use 2 classes to implement IPrincipal and IIdentity.
In them you have things like IsAuthenticated and Name and Roles.
(I also add other things that are not part of the interface.)
When the user logs in you use the Login method to communicate the
crednetials to your DB and verify them.
If they are successful then you store the Principal object in Session and
RedirectFromLogin.
Forms Authentication sends them an encrypted cookie.
This lets them get past the login page to the protected pages in your app.
In Global.asax you trap the AcquireRequestState event and pull your
Principal object out of Session and set the current thread to use it. Thsi
way every page in your app has access to your custom Principal.
So at the top of each page you can write code like:
If Not MyUser.IsInRole("Admin") Then
'Redirect to Home page
End If
HTH
PS - Rocky Lhotka's CSLA Framework explains this all in great detail.
Excellent book too.
http://www.lhotka.net/ArticleIndex.aspx?area=CSLA%20.NET
-- Joe Fallon > One, I've encountered a number of examples where they hold the role > information for each authenticated user in the > AuthenticationTicket.UserData. How secure is this? I would be worried > that the user could edit the contents of the cookie (if they knew the > encryption key) and grant them self's more access to areas they shouldn't > be allowed access to? Would it not be more secure to hold this > information in the Session Object? This would also apply to their > LoginID. > > > > Basically I guess I'm wondering how hard is it for them to break the > encryption that the AuthenticationTicket undergoes. > > > > Also, what is the standard way to limit any access to an aspx page based > on a roll? > > > > Finally how can I limit access to a file like a .pdf file though a .NET > role? > > > > Any help on any of these topics would be greatly appreciated. Thanks in > advance. > > > > Cheers! > > > > David Kyle > > Web Developer > > www.chloemag.com > > dkyle@chloemag.com > >
- Next message: Prince: "DataGrid Key Field - Actual Value"
- Previous message: Ben: "Transfering web control data from one page to another"
- In reply to: David Kyle: "Authentication Security"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
