ASP.NET SQL Server Setup Wizard

Question

I have a asp.net web project I am working on, and found out my roles and such are stored in an .mdf file. While reading on attempting to connect to it via SQL Management Studio (using SQLExpress 2005), I found this article:

https://help.maximumasp.com/SmarterTicket/Customer/KBArticle.aspx?articleid=878

Now, my question is - should I be doing this? I am going to upload the website to a hosting provider when finished, and would like the process to be as smooth as possible.

Does one normally just move the MDF file to the server along with the website, or is it better to have the information stored inside SQL Server itself? I do have a DB already for the website... can I integrate asp.net's role information into my own DB so that I only have a single DB to manage?

Thanks for reading, ~~Kolten

Answer 1

Using the ASP.NET membership provider is a valid way of managing your user credientials. Uploading the MDF file introduces the risk that someone may be able to get your MDF file and then get all of your users details. Having this stored in a SQL database provided by your hosting environment would usually be more secure, provided that the connection details aren't compromised, and you don't expose your self to SQL Injection attacks and your provider also doesn't expose themselves to SQL injection attacks.

The Membership information can be stored in the same database as the rest of your application as long as there is no name conflicts with the membership tables. You can create the tables required by specifying your database connection details on the aspnet_regsql command line.

Inside your web.config file you will need to modify the roleManager and membership providers so that you can specify the connection string to use. i.e.

<system.web>
    <roleManager enabled="true" defaultProvider="AspNetSqlRoleProvider">
      <providers>
        <remove name="AspNetSqlRoleProvider" />
        <add name="AspNetSqlRoleProvider" connectionStringName="MembershipSQLConnectionString"
             applicationName="/"
             type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
      </providers>
    </roleManager>
</system.web>