ASP.NET user login best practises

Question

I want to make a login system using ASP.NET (MVC). The last one I did was in PHP and it was 4 years ago.

I have looked a bit on the internet, and found some bad examples that involved SQL in Click events. Other information pointed to the ASP.NET built-in membership provider.

However, I want to roll my own. I don't want to use the built-in membership provider, as it only seems to work on MS SQL, and I don't like the idea of having a few foreign tables in my database.

I could probably think of something, but I need a few pointers in the right direction. It does not have to be high-security, but just regular common-sense security.

And I have a few direct questions:

1. A lot of systems seem to have the Session ID stored in a user table. I guess this is to tie a session to a user to prevent hijacking. Do check this everytime a user enters a page? And what do I do if the session expires?

2. Hashing, salting, what does it do? I know of MD5 hashing and I have used it before. But not salting.

   1. Best practises for cookies?

Answer 1

I would avoid the whole issue and use openid. There is a library available that you can use directly. Here is a link to a blog post about putting this in place

Answer 2

I dont know about best practices but I can tell you what I do. Its not hitech security but it does the job.

I use forms authentication. I receive the password secured with ssl via a textbox on the login page. I take that password and hash it. (Hashing is like one way encryption, you can get hash code that cant be reversed back to the password). I take that hash and compare it to the users hash in the database. If the hash's match i use asp.nets built in authentication handling, which handles cookies for me.

The FormsAuthentication class has methods available to do this fo you, such as SetAuthCookie and RedirectFromLogin. they will set the cookie and mark them as authenticated. The cookie asp.net uses is encrypted. I cant speak for its security level though, but its in fairly common use.

In my class i do the password check and use formsauth to handle the rest:

if(SecurityHelper.LoginUser(txtUsername.Text, txtPassword.Text))
{    
    FormsAuthentication.RedirectFromLoginPage(txtUsername.Text, true);
}

Answer 3

You can implement your own membership provider using the ASP.NET infrastructure, see MSDN docs for MemberShipProvider class.

Answer 4

The built in provider works well. It does actually work with MySQL, although I found it not to be as straight forward as the MS SQL version. If you can use then do, it'll save you hours of work.

If you need to use another data store then I concur with axel_c, if I was going to roll my own then I'd write a membership provider as per MS specification. It will make the code more maintainable for any developers following you.

Answer 5

A disadvantage of the Membership Provider by microsoft is that you can't use it in a domain driven approach. If you want to, you can create your own user object with your own password hash and still use the authentication cookies provided by Microsoft. Using these authentication cookies means that you don't have to manage the session IDs yourself.

public void SignIn(User user)
        {
            FormsAuthentication.SignOut();
           var ticket = new FormsAuthenticationTicket(1, user.UserName, DateTime.Now.AddMinutes(30), expires, alse, null);
            var encryptedTicket = FormsAuthentication.Encrypt(ticket);
            var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
            {
                Expires = ticket.Expiration
            };

            httpContextProvider.GetCurrentHttpContext().Response.Cookies.Add(authCookie);
        }

    public void SignOut()
    {
        FormsAuthentication.SignOut();
    }

I use my own user object and tables. I store my passwords hashed in the usertable with a unique salt per user. This is secure, easy to implement and it will fit in your design. Your database table won't be polluted by Microsofts membership provider crap.

Answer 6

Salting is the practice of adding a unqiue string of characters to whatever is being hashed. Suppose mySalt = abc123 and my password is passwd. In PHP, I would use hashResult = md5(mySalt + password).

Suppose the string is intercepted. You try to match the string, but you end up matching gibberish because the password was salted before encrypted. Just remember that whatever you use for salt must be continuous throughout the application. If you salt the password before storage, you must compare the hashed, salted password to the DB.

Answer 7

You can use the built in SQL membership provider - and you could set up a dedicated "user access" database if you don't want the .Net membership tables within your database - just specify that in the connection string.

THe advantage with the provider model is at the application level, the code is independent of what particular authentication store you have used.

There are a good series of tutirials on the asp.net site:

link text