Home/ Questions/Q 7821423
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-02T07:38:49+00:00

I’m trying to understand how authentication in ASP.NET MVC works. I do not want

  • 0

I’m trying to understand how authentication in ASP.NET MVC works. I do not want the built-in MembershipProvider creating a local database behind the scenes. I’ve also looked at some blog posts talking about custom membership providers. While looking for a much simpler forms authentication model, I found the following:

FormsAuthentication.SetAuthCookie("myusername", true);
FormsAuthentication.SignOut();

The idea is to send the username and salted hashed password to the database and see if they match a record in there. If the user exists, then I pass the username to SethAuthCookie. My questions are:

  • Should the username be encrypted?
  • What happens if there are multiple servers and the user is surfing the website? I believe any one of the servers can serve content to the user, so how do they know if the user has been authenticated?
  • What’s the preferred way of authenticating users in MVC without providers? Am I on the right track or should I be looking into something else?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Should the username be encrypted?

    No.

    What happens if there are multiple servers and the user is surfing the
    website? I believe any one of the servers can serve content to the
    user, so how do they know if the user has been authenticated?

    At each request the server reads the authentication cookie that is sent by the client browser and which was generated by the FormsAuthentication.SetAuthCookie call, decrypts it and retrieves the username that is stored inside. Just make sure that you have set the same machine keys for all nodes of your server farm so that no matter which node emitted the authentication cookie, all other nodes can decrypt it.

    What’s the preferred way of authenticating users in MVC without
    providers? Am I on the right track or should I be looking into
    something else?

    You are on the right track. You use the FormsAuthentication.SetAuthCookie method to emit the authentication cookie once you have verified that the password hash matches the one of the user in the database and in subsequent actions you could use the User.Identity.Name property to retrieve the currently authenticated user.

    I would also recommend you checking out the following article which provides a good overview of how forms authentication works in ASP.NET.

    • 0