Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’ve read from a few individuals (Simone Chiaretta, Sebastien Lambla) that “you should remove the AccountController” from your ASP.NET MVC apps, but without much reason. I’m currently using it in one intranet site and am working on a second that will be considerably more widely used. What is wrong/bad about the default code that makes it undesirable?
Simone elaborates in comments. I have to disagree with him a little, though. Correctly implementing an authorization filter is not “easy.” The first MVC previews got it wrong! In general, nothing which touches the area of security is “easy.” However, the criticism of coupling is valid. Even if you use forms auth — and you probably should use some off-the-shelf authentication if you’re not a security expert — the coupling is bad.