Chapter 13: Security and User Authentication

open. If they close their browsers, reopen them, and navigate to your site, they’ll have to log in again.2

Once you enter the correct name and password, you’ll be forwarded to the page you initially requested—by default, this is the homepage.

Configuring Forms Authentication

In the previous section, we created a basic login page. We also modified the Web.config file to enable the forms authentication mode. In this section, we’ll explore the forms authentication section of the Web.config file in greater detail.

Aside from the basic authentication mode, the <authentication> tag within the Web.config file may contain a <forms> tag. The <forms> tag accepts the following attributes:

loginUrl

This attribute specifies the page that the user is redirected to when authentication is necessary. By default, this page is called login.aspx. Using this attribute, you can modify the filename to anything you like.

name

This attribute specifies the name of the cookie to be stored on the user’s machine. By default, the name is set to .ASPXAUTH.

timeout

This attribute specifies the amount of time in minutes before the cookie expires. By default, this value is set to 30 minutes.

path

This attribute specifies the path to the location at which the cookie is stored. By default, this value is set to /.

protection

This attribute controls the way(s) the cookie data is protected. Values include

All, None, Encryption, and Validation. The default value is All.

cookieless

A new ASP.NET 2.0 feature, this attribute forces your application to use the

URL instead of a cookie to identify the logged-in user. The possible values

2 You could add a Remember Me checkbox, and decide the value of the second parameter based on the user’s preference.

538

Working with Forms Authentication

are UseCookies (use the cookie to identify the user), UseUri (use the URL to store identification data), AutoDetect (try to detect if the user client supports cookies), or UseDeviceProfile (use cookies if the user client is known to support them). The default is UseDeviceProfile.

Applying the cookieless authentication mode is similar to using cookieless sessions, and can be used to support visitors who have cookies disabled. When the URL is used to identify the visitor, the links in your web site will automatically be modified to include the identification information, and will look like this:

http://localhost/Dorknozzle/(F(oyVZpBZ3w7Iz_LEFRukBigAf nxM5QzvMY374YdcVjfcfgKJt8SJ3x9pVlrvUSUKbAiMuTP4rylvvNi7 HQH3ta9kMmQWQmZM5aT13GkenHPk1))/Default.aspx

slidingExpiration

This attribute specifies whether the cookie’s expiration date (which is specified using the timeout attribute) should be reset on subsequent requests of a user’s session. The default value in ASP.NET 1.x was True, and the default value in ASP.NET 2.0 is False.

An example Web.config file to which the <forms> tag has been applied might look like this:

<configuration>

<system.web>

<authentication mode="Forms">

<forms name=".LoginCookie" loginUrl="Login.aspx" protection="All" timeout="40" path="/" cookieless="UseUri" />

</authentication>

<authorization>

</authorization>

</system.web>

</configuration>

Configuring Forms Authorization

As is the case with the authentication section of the Web.config file, the <authorization> tag can be modified to provide or deny certain users access to your application, allowing you to make extremely specific decisions regarding who will, and will not, be accepted into the app. For instance, the following code allows all non-anonymous (authenticated) users except for zruvalcaba:

539

Chapter 13: Security and User Authentication

<configuration>

<system.web>

<authentication …>

</authentication>

<authorization> <deny users="?" />

<deny users="zruvalcaba" />

</authorization>

</system.web>

</configuration>

Here, we again use the question mark (?) to force users to log in, thus denying anonymous users access to our application. We’ve also added another <deny> tag, for the user zruvalcaba. In a nutshell, the two deny elements will allow everyone except zruvalcaba to log in.

In addition to <deny> tags, the <authorization> tag may contain <allow> tags—we’ll see an example of this in a moment. For each user who attempts to access the application, ASP.NET will read through the tags in <authorization> and find the first tag that matches that user. If it turns out to be a <deny> tag, that user is denied access to the application; if it’s an <allow> tag, or if no matching tag is found, the user is granted access.

The users attribute of <allow> and <deny> will accept three types of values:

?

Use this value to allow or deny all anonymous users. This is the most common value used with forms authentication.

*

Use this value to allow or deny all users, including users who are logged in.

user, …

As with zruvalcaba above, we can allow or deny access to a specific user via this attribute. We can list several users by separating their names with commas.

We could modify the code a bit further in an effort to allow only specific users:

<configuration>

<system.web>

<authentication …>

</authentication>

540

Working with Forms Authentication

<authorization>

<allow users="jruvalcaba,zruvalcaba" /> <deny users="*" />

</authorization>

</system.web>

</configuration>

In this case, the users with the login names of jruvalcaba and zruvalcaba are allowed access to the application, but all other users (whether they’re logged in or not) will be denied access.

Now that you have a basic understanding of the ways in which user access is configured within the Web.config file, let’s see how we can use Web.config to store a list of users for our application.

Storing Users in Web.config

The great thing about the Web.config file is that it is secure enough for us to store user names and passwords in it with confidence. The <credentials> tag, shown here within the forms element of the Web.config file, defines login credentials for two users:

File: Web.config

<authentication mode="Forms">

<forms>

<credentials passwordFormat="Clear" > <user name="zak" password="zak" />

<user name="jessica" password="jessica" /> </credentials>

</forms>

</authentication>

<authorization> <deny users="?" />

</authorization>

As we want to prevent users from browsing the site if they’re not logged in, we use the appropriate <deny> tag in our <authorization> tag. The names and passwords of the users we will permit can then simply be specified in the <credentials> tag. Change your Web.config file to match the one shown above, and we’ll try another example.

Let’s modify the code that lies within the <head> tag of the Login.aspx page to validate the user names and passwords based on the Web.config file. Here’s what this change looks like:

541