1

I am new to ASP.NET (obviously). I need to create a really simple database driven user login system using ASP.NET. In PHP this is simple; just call session_start() at the top of the page and the session will be created or resumed. Then it is just a matter of connecting to the database and authenticating the user. I was able to learn this in less than 2 hours using php.

With ASP.NET and visual studio I am not having as good a luck. I have researched a bit, although not as much as I would like because I do not have a lot of time to spend on this, and read about two ways to implement logins. First you can use the password forms controls and put the user/pass info in the web.config. Second you could use the Membership API. I did not like either of these.

Is there not a way to do very simular to php where you just start the stinkin session, connect to the database, authenicate and your done? I am sure there is, I just haven't had the time required to research this as much as needed due to classes and work. I was hoping someone here could save me a little time and just tell me what to lookup! Thank you in advance!

btw, I want to use visual studio 2010 (if that matters).

user270014
  • 581
  • 3
  • 21
cchampion
  • 7,607
  • 11
  • 41
  • 51
  • 4
    http://msdn.microsoft.com/en-us/library/ms178329.aspx , http://www.asp.net/web-forms/tutorials/security/introduction/an-overview-of-forms-authentication-vb – Mitch Wheat Feb 05 '12 at 02:33
  • http://stackoverflow.com/questions/2771094/how-do-i-create-a-custom-membership-provider-for-asp-net-mvc-2/ – Joakim Feb 05 '12 at 02:44

2 Answers2

3

If you create a web application, and use the default then it generates a template that has the full login system already implemented. You don't have to do anything, just modify the pages for your own purposes.

You should use the Membership API. It's simple, and easy. You should use the FormsAutentication system, it's secure and robust, and well tested. It takes seconds to implement, not two hours.

Erik Funkenbusch
  • 92,674
  • 28
  • 195
  • 291
  • I will give the Membership API another chance. It seemed overly complicated in the book I was reading about it but I will find a different book. I mainly wanted to make sure there is nothing I was only looking. It does seem that Membership API and FormsAutentication are the two primary ways of implementing it. – cchampion Feb 05 '12 at 06:16
  • @cchampion - You don't need to read a book about it. Just do it. Create a new WebApplication project, and run it. You're done. You may want to read about how the authorization system works, but that will give you a tool to test it. – Erik Funkenbusch Feb 05 '12 at 06:41
  • You were right, I gave Membership a second chance and this time I am very happy with it! I knew how to create a web app with login in seconds but I wasn't very satisified with it because I hate not knowing how my code works! Then when I went reading about it the first book I picked up sucked. You convinced me to try again and I am glad I did. Thank you! – cchampion Feb 09 '12 at 13:39
0

You can use Session.

Store the username and password on database, then you can create an ASP.Net form to log the user, where you will check if the given information match.

For example, if password and username match, you create a Session["Logged"] = true; if not: Session["Loged"] = false

Sorry about my english!

fvss
  • 143
  • 1
  • 1
  • 8
  • Using session is a very bad idea. Session can easily be hijacked, which means that if your session is hijacked, your attacker automatically gets access. On top of that, session times out at unpredictable times. Finally, authorization (which is different from authentication) needs to be done earlier in the pipeline before the session is available. – Erik Funkenbusch Feb 05 '12 at 03:15
  • However, I don't think session is not a solution. The answer from @fvss shouldn't get a downvote. –  Feb 05 '12 at 03:26
  • Mystere Man, you are right when you said the session is not as secure as using Membership API. But cchampion told that he doesn't like the way it works, so I can not think another way but Session. – fvss Feb 05 '12 at 03:44
  • @fvss - There are many other ways, besides using session. You can write your own IPrincipal and IIdentity handlers. – Erik Funkenbusch Feb 05 '12 at 04:05
  • @allentranks - Session is NEVER the answer for authentication, it's insecure, prone to buggyness, and is the wrong way to do it. Downvoting is the only way to make it clear that this is not a solution, it's a problem masquerading as a solution. – Erik Funkenbusch Feb 05 '12 at 04:06