ASP.NET Forms Authentication - Part 1

by Abel Banda
01/06/2003

Introduction

Often, in legacy Web applications, users authenticate themselves via a Web form. This Web form submits the user's credentials to business logic that determines their authorization level. Upon successful authentication, the application then submits a ticket in the form of a cookie, albeit a hard cookie or session variable. This ticket contains anything from just a valid session identification access token to customized personalization values.

ASP.NET encompasses and extends the very same logic described above into its architecture as an authentication facility, Forms Authentication. Forms Authentication is one of three authentication providers. Windows Authentication and Passport Authentication make up the other two providers. In this article, we will focus on Forms Authentication.

Forms Authentication is a system in which unauthenticated requests are redirected to a Web form where users are required to provide their credentials. Upon submitting the form, and being properly verified by your application, an authorization ticket is issued by your Web application in the form of a cookie. This authorization cookie contains the user's credentials or a key for reacquiring the user's identity (e.g. therefore making the identity persistent). In essence, Forms Authentication is a means for wrapping your Web application around your own login user interface and verification processes.

Related Reading .NET Windows Forms in a Nutshell By Ian Griffiths, Matthew Adams

Forms Authentication Flow

1. A client generates a request for a protected resource (e.g. a secured page from your site).
2. IIS (Internet Information Server) receives the request. If the requesting client is authenticated by IIS, the user/client is passed on to the ASP.NET application. Note that if Anonymous Access is enabled, the client will be passed onto the ASP.NET application by default. Otherwise, Windows will prompt the user for credentials to access the server's resources. Also note that because the authentication mode in the ASP.NET application is set to Forms, IIS authentication cannot be used.
3. If the client doesn't contain a valid authentication ticket/cookie, ASP.NET will redirect the user to the URL specified in the loginURL attribute of the Authentication tag in your web.config file. This URL should contain the login page for your application. At this URL, the user is prompted to enter their credentials to gain access to the secure resource.
4. The client must provide credentials, which are then authenticated/processed by your ASP.NET application. Your ASP.NET application also determines the authorization level of the request, and, if the client is authorized to access the secure resource, an authentication ticket is finally distributed to the client. If authentication fails, the client is usually returned an Access Denied message.
5. The client can then be redirected back to the originally-requested resource, which is now accessible, provided that the client has met the authentication and authorization prerequisites discussed above. Once the authorization ticket/cookie is set, all subsequent requests will be authenticated automatically until the client closes the browser or the session terminates. You can have the user's credentials persist over time by setting the authorization ticket/cookie expiration value to the date you desire to have the credentials persist through. After that date, the user will have to log in again.

Setting Up Forms Authentication

Let's take a look at the applicable settings to execute Forms Authentication. In general, setting up Forms Authentication involves just a few simple steps.

1. Enable anonymous access in IIS. By default, anonymous users should be allowed to access your Web application. In rare cases, however, you may opt to layer an Integrated Windows OS security layer level with Forms authentication. We will discuss how to integrate this layer with anonymous access enabled in the article succeeding this one ("Part 2 (Integration w/ Active Directory)").
2. Configure your Web application's web.config file to use Forms Authentication. Start by setting the authentication mode attribute to Forms, and denying access to anonymous users. The following example shows how this can be done in the web.config file for your Web application:

   
   <configuration>
     <system.web>
       <authentication mode="Forms">
         <forms name=".COOKIEDEMO" 
                loginUrl="login.aspx" 
                protection="All" 
                timeout="30" 
                path="/"/> 
       </authentication>
       <authorization>
         <deny users="?" />
       </authorization>
     </system.web>
   </configuration>
   

   Upon setting the authentication mode to Forms, you'll notice that we appended another child element. The Forms element has five attributes that implement your forms authentication configuration. The attributes and their descriptions are as follows :

   Attribute	Description
   name	This is the name of the HTTP cookie from which we will store our authentication ticket and information, respectively.
   loginURL	This is the URL from which your unauthenticated client will be redirected. In most scenarios, this would be your login page, where the client is required to provide their credentials for authentication.
   protection	This is used to set the method from which to protect your cookie data. The following valid values can be supplied: All: Specifies to use both data validation and encryption to protect the cookie. Triple DES is used for encryption, if it is available and if the key is long enough (48 bytes). The All value is the default (and suggested) value. None: Used for sites that are only using cookies for personalization and have weaker requirements for security. Both encryption and validation can be disabled. This is the most efficient performance wise, but must be used with caution. Encryption: Specifies that the cookie is encrypted using Triple DES or DES, but data validation is not done on the cookie. It's important to note that this type of cookie is subject to chosen plaintext attacks. Validation: Specifies to avoid encrypting the contents of the cookie, but validate that the cookie data has not been altered in transit. To create the cookie, the validation key is concatenated in a buffer with the cookie data and a MAC is computed/appended to the outgoing cookie.
   timeout	This is the amount of time (in integer minutes) that the cookie has until it expires. The default value for this attribute is 30 (thus expiring the cookie in 30 minutes). The value specified is a sliding value, meaning that the cookie will expire n minutes from the time the last request was received.
   path	This is the path to use for the issued cookie. The default value is set to "/" to avoid issues with mismatched case in paths. This is because browsers are case-sensitive when returning cookies.

   In our web.config file, it's also important to note the value we have for the deny child element of the authorization section (as highlighted below). Essentially, we set that value of the users attribute to "?" to deny all anonymous users, thus redirecting unauthenticated clients to the loginURL.

   
   <configuration>
     <system.web>
       <authentication mode="Forms">
         <forms name=".COOKIEDEMO" 
                loginUrl="login.aspx" 
                protection="All" 
                timeout="30" 
                path="/"/> 
       </authentication>
       <authorization>
         <deny users="?" />
       </authorization>
     </system.web>
   </configuration>
   

3. Create your login page (as referenced in the loginURL attribute discussed above). In this case, we should save our login page as login.aspx. This is the page to where clients without valid authentication cookie will be redirected. The client will complete the HTML form and submit the values to the server. You can use the example below as a prototype.

   
     <%@ Import Namespace="System.Web.Security " %>
   <html>
     <script language="C#" runat=server>
     void Login_Click(Object sender, EventArgs E) 
     {
     
       // authenticate user: this sample accepts only one user with
       // a name of username@domain.com and a password of 'password'
       if ((UserEmail.Value == "username@domain.com") && 
           (UserPass.Value == "password")) 
       {
         FormsAuthentication.RedirectFromLoginPage(UserEmail.Value, 
                                                   PersistCookie.Checked);
       } 
       else 
       {
         lblResults.Text = "Invalid Credentials: Please try again";
       }
     }
     </script>
     <body>
       <form runat="server">
         <h3>Login Page</h3>
         <hr>
         Email:<input id="UserEmail" type="text" runat="server"/>
         <asp:RequiredFieldValidator ControlToValidate="UserEmail" 
                                     Display="Static" 
                                     ErrorMessage="*" 
                                     runat="server"/>
         <p>Password:<input id="UserPass" 
                            type="password" 
                            runat="server"/>
         <asp:RequiredFieldValidator ControlToValidate="UserPass" 
                                     Display="Static" 
                                     ErrorMessage="*" 
                                     runat="server"/>
         <p>Persistent Cookie:<ASP:CheckBox id="PersistCookie" 
                                            runat="server" />
         <p><asp:button id="cmdLogin" 
                        text="Login" 
                        OnClick="Login_Click" 
                        runat="server"/>
         <p><asp:Label id="lblResults" 
                       ForeColor="red" 
                       Font-Size="10" 
                       runat="server" />
       </form>
     </body>
   </html>
   

   It's important to note that the above page authenticates the client on the click event of the cmdLogin button. Upon clicking, the logic determines if the username and password provided match those hard-coded in the logic. If so, the client is redirected to the requested resource. If not, the client is not authorized, and thus receives a message depicting this.

   You can adjust the logic to fit your needs, as it is very likely that you will not have your usernames and passwords hard-coded into the logic. It is here at the Login_Click function that you can substitute the logic with that of your own. It is common practice to substitute database logic to verify the credentials against a data table with a stored procedure.

   You can also provide authorized credentials in the web.config file. Inside the forms section, you would append a user element(s), as follows :

   
     <configuration>
     <system.web>
       <authentication mode="Forms">
         <forms name=".COOKIEDEMO" 
                loginUrl="login.aspx" 
                protection="All" 
                timeout="30" 
                path="/"> 
           <credentials passwordFormat="Clear">
             <user name="user1" password="password1"/>
             <user name="user2" password="password2"/>
             <user name="user3" password="password3"/>
           </credentials>
         </forms>
       </authentication>
       <authorization>
         <deny users="?" />
       </authorization>
     </system.web>
   </configuration>
   

Doing so allows you to authenticate against a list of users in your web.config file, easily. You can append as many users as necessary. To authenticate against that list of users, you would append the applicable logic in the click event of the cmdLogin button discussed above. Here is the code :

void Login_Click(Object sender, EventArgs E) 
{
  // authenticate user: this sample authenticates 
  // against users in your app domain's web.config file
  if (FormsAuthentication.Authenticate(UserEmail.Value,
                                       UserPass.Value))
  {
    FormsAuthentication.RedirectFromLoginPage(UserEmail.Value, 
                                              PersistCookie.Checked);
  } 
  else 
  {
    lblResults.Text = "Invalid Credentials: Please try again";
  }
}

Client Requirements

To enable forms authentication, cookies must be enabled on the client browser. If the client disables cookies, the cookie generated by Forms Authentication is lost and the client will not be able to authenticate.

Coming in Next Part of This Series

In the next part of this series, we'll discuss how to incorporate Active Directory with Forms Authentication, to get that Windows OS layer of security without forcing the user to authenticate twice, once through your user interface and again through the Windows user interface.

Abel Banda

---

Return to ONDotnet.com