Password protection for ASP.NET web pages?

Question

I am trying to implement the simplest shared 'files' folder for a website but wish to have a 'reasonable' level of access control - i.e no casual multimegabyte uploads from passing hoi-polloi.

Users are given a password etc. They then log-in, once credentials are successfully checked, they are given one of two possible access rights - read-only (RO) or read-write (RW) access to the files. 'write' in this context means they can upload files.

User management/registration/password reminders can all be handled manually - no code required at this point.

What is the best way to do this:

1. Write a secret in the session variables?
2. Store some kind of time-limited session key as a local cookie?
3. Check the local database for some kind of session key?
4. (heading for the too complex) use pukka .NET authentication mechanisms

Any constructive suggestions welcomed. I'd be especially delighted if someone could point me to a good example of the breed that was C#/ASP.NET based.

Many thanks

Jerry.

Answer 1

I see no reason to reinvent the wheel when there are build in authentication mechanisms within asp.net. The easiest thing to implement would be asp.net forms authentication.

Here is a writeup on it: http://www.15seconds.com/Issue/020220.htm

You can map permissions for directories in the web.config and you can even store users and passwords here as well if you chose to go that route. That would be the easiest to get off the ground quickly, although not all that flexible or future proof.

Then you have asp.net Membership. This is an asp.net 2.0 feature which uses a provider model to provide membership features. There is a SqlMembershipProvider which provides all the plumbing you need to store membership information in a sql server database (there are scripts to automatically create the tables, sprocs etc as well).

More info here: http://msdn.microsoft.com/en-us/library/ms998347.aspx http://aspnet.4guysfromrolla.com/articles/102208-1.aspx

This is a bit more complex, but also much more robust.

Answer 2

Easiest example:

http://www.asp101.com/samples/login_aspx.asp