ASP.NET - Manual authentication system

Question

Hello all,

Wer'e developing an ASP.NET C# application, which will contain an authentication system that authenticates users in multiple levels (user, admin, super-admin, etc.).

Our idea is NOT to use the built in ASP.NET forms authentication feature. Our plan is to create a whole 'new' system for it- based on the Session object, and SQL database contains users' info such as username & password.

Is there any SERIOUS different between our idea to the Forms authentication feature?

What security risks do we take? How do we solve them?

Is this a good alternative for the forms authentication feature?

Thanks in advance !

Answer 1

Thing is, you can mix and match the Membership Provider, Forms Authentication and the Roles Provider to pretty much cater for most scenarios. Would these not suit your needs? Do you really need to re-invent the wheel?

Answer 2

I would be curious to know the reason your aversion to the built in Membership providers.

Take a look at this link. http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx It explains how to implement a custom MembershipProvider, which you can use to authenticate against any existing/planned database/store, whether it is session based (not sure how this would be persisted) or in a relational database.

Your requirement for Super users and Admin users etc falls nicely into the Role Provider system. It really is very easy to use and the ASP.NET team at microsoft have already considered the security risks and how to solve them.

Have a read of these two blogg entries by scott Guthrie:

http://weblogs.asp.net/scottgu/archive/2006/02/24/ASP.NET-2.0-Membership_2C00_-Roles_2C00_-Forms-Authentication_2C00_-and-Security-Resources-.aspx

http://weblogs.asp.net/scottgu/archive/2006/01/10/435038.aspx

Answer 3

You can still have ASP.NET handle the authentication cookies and the like for you. If you want to use your own db stuff then that's fine. Some would argue that if it can fit into the membership system from ASP.NET then do so (via the providers framework).

If that isn't a good fit, you can create your own login forms but I would strongly recommend that you use the FormsAuthentication cookie and session management at the very minimum. Its already done, tested and its got its own config in the web.config file. So why do it again?