Chapter 13: Security and User Authentication

This approach is particularly useful when you’re transferring very sensitive data such as user passwords, credit card information, and so on. However, HTTPS isn’t used in scenarios where the extra security doesn’t bring benefits, because it consumes significant processing power on the server—especially when many users access the site simultaneously.

In this chapter, we’ll explore the basic ASP.NET 2.0 features for implementing user authentication and authorization to protect the sensitive areas of your web site.

Securing ASP.NET 2.0 Applications

The ASP.NET 1.0 and ASP.NET 1.1 server model offered several robust options for storing user information. ASP.NET 2.0 adds many improvements to these basic security features.

In securing the sensitive pages of a web site, you’ll need to deal with two basic security-related concepts: authentication and authorization.

authentication

Authentication is the process by which an anonymous user is identified as a particular user of your system.

Authentication mechanisms include providing a username/password combination, using a fingerprint reader, and so on. As a result of this process, the person (or process, or computer) accessing your web site is associated with a security token (such as a username) which identifies the user into your system.

authorization

Authorization establishes the resources an authenticated user can access, and the actions that user is allowed to perform. For example, you’ll probably want to give different permissions to anonymous users, to registered users, and to site administrators.

To ease the administrative work, modern authorization systems, including those supported by ASP.NET, support the notion of authorization roles

(or groups) . A role represents a set of permissions that can be associated with any user who needs all the permissions associated with that role. For example, you could build a role called Administrators, and associate the permissions typically required by an administrator to that role. Then, when you need to give administrative permissions to a user, you simply assign that user

530

Securing ASP.NET 2.0 Applications

to the Administrators role, instead of supplying all the related permissions manually.

With older versions of ASP, user names and passwords were either hard-coded into the ASP file, or stored in an external data store such as a database. ASP.NET offers a better way to implement these old techniques, and also adds new user authentication methods:

Windows authentication

Windows authentication uses IIS in conjunction with the users’ operating system user accounts to allow or deny those users access to certain parts of your web application.

forms authentication

Offering the greatest flexibility, forms authentication provides the maximum control and customization abilities to the developer. Using forms authentication, you can authenticate your users against hard-coded credentials, credentials stored in your Web.config file, user account details stored in a database, or a combination of these.

Passport authentication

The newest addition to user authentication methods, Passport authentication is a centralized authentication service provided by Microsoft. It allows users to sign in to multiple web sites using Microsoft Passport accounts, which are associated with their email addresses. Developers who use this authentication method don’t need to worry about storing credential information on their own servers.

When users log in to a site that has Passport authentication enabled, they are redirected to the Passport web site, which prompts them for their email addresses and passwords. After the information is validated, the users are automatically redirected back to the original site.

This method sounds good, but it has one major downside: it requires users to have a Passport account in order to use your site, and it ties your application to Microsoft’s proprietary system.

We’ll spend the rest of this chapter exploring forms authentication—the most popular authentication method supported by ASP.NET.

531