ASP.NET SECURITY

transcript

ASP.NET SECURITY

Presenter: Van Nguyen

Introduction

Security is an integral part of any Web-based application. Understanding ASP.NET security will

help in building secure Web applications. This document provides a brief overview of security in

ASP.NET.

Introduction

I. ASP.NET Web application security

II. FormsAuthentication

III. Manager Users Using Membership

IV. Managing Authorization using Roles

ASP.NET architecture ASP.NET Data Flow ASP.NET Authentication ASP.NET Authorization ASP.NET impersonation

ASP.NET architecture

IIS Security Anonymous Basic Digest Integrated Windows Authentication Certificate

ASP.NET Data Flow The security data flow for two common

scenarios:1. Impersonation.2. Forms authentication using cookies.

ASP.NET Authentication:− Authentication is the process of obtaining identification credentials such as name and password from a user and validating those credentials against some authority.

Windows Authentication Provider. (Asp.net Impersonation)

Forms Authentication Provider. (FormsAuthentication)

Authorization determines whether an identity should be granted access to a specific resource. In ASP.NET Authorization, there are two ways to authorize access to a given resource:

File authorization URL authorization

I. ASP.NET Web application security ASP.NET impersonation:

ASP.NET impersonation:− ASP.NET impersonation is disabled by default. − If impersonation is enabled for an ASP.NET application,

that application runs in the context of the identity whose access token IIS passes to ASP.NET.

− Web application base on IIS to authenticate users.− Server should provide different Window users for every

application to avoid access resource to other web application. <configuration>

<system.web> <authentication mode="Windows“/> <identity impersonate="true"/> </system.web></configuration>

II. FormAuthentication

Forms authentication uses an authentication ticket that is created when a user logs on to a site, and then it tracks the user throughout the site. The forms authentication ticket is usually contained inside a cookie.

Configuration FormsAuthentication in web.config:

Credentials Store in web.config: Forms authentication credentials that are used to validate users at logon can be stored in an external data source or in the application configuration file.

Logging In, Logging Out using FormsAuthentication.

Logging In:

Logging Out:FormsAuthentication.SignOut();FormsAuthentication.RedirectToLoginPage();

if (FormsAuthentication.Authenticate(model.UserName, model.Password) || Membership.ValidateUser(model.UserName, model.Password)) { FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);

//FormsAuthentication.RedirectFromLoginPage(userName,isPresistentCookie); }

Understanding Persistent tickets: The forms authentication ticket was always stored in a cookie. So, the decision between using a persistent versus nonpersistent ticket is a choice between using persistent or session-based cookie.

The following code issues a persistent ticket:

FormsAuthentication.RedirectFromLoginPage("testuser", true);

III. Manager Users Using Membership ASP.NET membership therefore helps you manage user

authentication in your Web sites. You can use ASP.NET membership with ASP.NET forms authentication by using with the ASP.NET login controls to create a complete system for authenticating users.

Benefit of ASP.NET membership:• Create new user and password.• Using the Login controls in asp.net.• Storing membership information in database.• Authenticating users who visit your site.• Managing passwords (creating, changing and resetting them).• Specifying a custom membership provider.

Configuration Membership:

Install DataBase: Run file C:\Windows\Microsoft.NET\Framework64\v4.0.30319\

aspnet_regsql.exe

Finish:

Membership class.

Role management lets you treat groups of users as a unit by assigning users to roles.

Role management helps you manage authorization, which enables you to specify the resources that users in your application are allowed to access.

Using RoleProvider to make a custom Role management.

IV. Managing Authorization using Roles

Configuration RoleProvider:

Authorization using Role:

Thanks for your listening

ASP.NET SECURITY

Documents