ASP.NET Membership - Is Switching the Application Name in the Web.Config a good idea?

Question

Hi Guys,

I came up with an interesting way to solve the following problem and I want to know if there is a better way to achieve my objectives.

Basically, I'm creating a basic cms system users can register for their own microsite and have their own users. I'm using the asp.net membership api.

I wanted a way to isolate users of the various microsites from eachother so that a user authenticated with www.mysite.com/johns-site wouldn't also be authenticated with www.mysite.com/pauls-site.

I also wanted a way to associate a username with a microsite so that if a user is registered as bob on one site, it doesn't stop another user registering as bob for a different microsite.

To achieve this, I noticed that in the asp membership tables a user belongs to an application. Every time I receive a request, I have a method that switches the applicationName in the web.config based on the url.

This does meet my objectives in an easy way but feels a bit hacky. Is there an alternative way to switch applications for the membership provider?

Answer 1

It is possible to get/set the ApplicatioName property at run time however according to the below MSDN post it is not recommended as the property is not thread safe i.e. if multiple users are creating accounts for different applications at the same time it may not correctly allocate the ApplicationName per user.

Syntax:

Membership.ApplicationName = "MyAppName"

OR

Membership.ApplicationName = "MyAppName";

Further reading:

http://msdn.microsoft.com/en-us/library/system.web.security.membership.applicationname.aspx

Note:

You are updating the contents of the web.config file from the application code? If so this is most certainly "hacky". Plus editing the web.config will drop any active sessions (if your app uses session state of course).

Answer 2

I agree, it is a hack that will likely make you pay at some point.

The proper way to accomplish this would involve each virtual directory (or microsite as you say) each defining a <membership> element with the same connection string but different applicationName attribute.