Question

I want to make a login system using ASP.NET (MVC).

On the internet, I found some bad examples that involved SQL in Click events. Other information pointed to the ASP.NET built-in membership provider.

However, I want to roll my own. I don’t want to use the built-in membership provider, as it only seems to work on MS SQL, and I don’t like the idea of having a few foreign tables in my database.

I could probably think of something, but I need a few pointers in the right direction. It does not have to be high-security, but just regular common-sense security.

And I have a few direct questions:

1. A lot of systems seem to have the Session ID stored in a user table. I guess this is to tie a session to a user to prevent hijacking. Do check this every time a user enters a page? And what do I do if the session expires?

2. Hashing, salting, what does it do? I know of MD5 hashing and I have used it before. But not salting.

3. Best practices for cookies?

Answer 1

I dont know about best practices but I can tell you what I do. Its not hitech security but it does the job.

I use forms authentication. I receive the password secured with ssl via a textbox on the login page. I take that password and hash it. (Hashing is like one way encryption, you can get hash code that cant be reversed back to the password). I take that hash and compare it to the users hash in the database. If the hash’s match i use asp.nets built in authentication handling, which handles cookies for me.

The FormsAuthentication class has methods available to do this fo you, such as SetAuthCookie and RedirectFromLogin. they will set the cookie and mark them as authenticated. The cookie asp.net uses is encrypted. I cant speak for its security level though, but its in fairly common use.

In my class i do the password check and use formsauth to handle the rest:

if(SecurityHelper.LoginUser(txtUsername.Text, txtPassword.Text)) {         FormsAuthentication.RedirectFromLoginPage(txtUsername.Text, true); }