Question

Hi I am trying to create an e-commerce website with asp.net MVC3.I am at the part where I have to login the User into my application.I can validate it’s credentials but I can not seem to able to log him in.Here is what I have so far:

if(Membership.ValidateUser(model.Username , model.Password))
{
    if(string.IsNullOrEmpty(returnUrl))
    {
        return RedirectToAction("Index", "Home");
    }
    else
    {
        return RedirectToAction("Index" , returnUrl);
    }
}

I know I still have to add something here to log the user into my application but I do not know what.Can anyone please tell me what do I have to do next?

Answer 1

If you’re using Forms authentication, you need to set the Authentication cookie:

    if(Membership.ValidateUser(model.Username , model.Password))
    {
        FormsAuthentication.SetAuthCookie( model.UserName, model.RememberMe );
        if(string.IsNullOrEmpty(returnUrl))
            {//...

Also, you should read this article on preventing open redirection attacks.