Programming Microsoft Web Forms (Pro Developer)

Overview

One of the areas of Microsoft ASP.NET that I have a special interest in is application security, especially with respect to user security and administration. I do a great deal of work in the health care industry, so in addition to the normal Web site security concerns, I must also be aware of any legal requirements. For me, this is simply a matter of doing the right thing. As a patient, I expect that my personal medical information will be kept secure and that it will remain between my healthcare providers and me.

Even if your site itself does not contain data of high value, properly managing users credentials is a very important security issue. Here's an example. I recently worked on a secure site for a manufacturer. The user names and passwords required for the site were merely intended for user personalization, rather than for protection of user data. Nevertheless, I insisted that the security system use one-way hashing on the passwords supplied by the users. Using a one-way hash meant that even I would not be able to decrypt the passwords. To be verified, a password supplied by a user would be hashed and then compared to the hash stored in the database. However, if a user forgot his or her password, recovering it would be a bit more complex than just e-mailing the password to the user.

Management objected to the minor amount of extra development time and possible user inconvenience this might cause. I reminded them that users often use a single password for many sites; any compromise to their site, regardless of the value of the site's contents, could help the bad guys compromise other sites of higher value. To illustrate this point, I visited one of the company's existing public Web sites and used its terribly designed password recovery option. By entering the e-mail address of one of the company's managers, I was able to retrieve the manager's password for the site, which, to the horror of all involved, was the same password that the manager used as his Microsoft Windows domain password. After that, I encountered no more resistance to using best practices to handle user names and passwords.

Implementing user management correctly is not necessarily hard. But it does involve some work, and doing it right often involves a little more work than doing it wrong. After you have built several sites, you discover that virtually all of the code used to log in and manage users is the same from project to project. Realizing this, the developers of ASP.NET 2.0 added a complete set of components for managing user login, registration, and administration. The controls, and the underlying security providers, use best practices to help keep users' information secure. Even better, a Web-based interface allows you to manage many administrative aspects of your Web site.

This chapter will cover all aspects of managing users of your ASP.NET 2.0 Web Forms applications. First, I will discuss the new Web site administration user interface. This tool allows you to perform much of the site configuration that previously required manual editing of the Web.config file. Next, I will cover the login controls that are new to ASP.NET 2.0, which you can use to add user security to your Web Forms applications. The login controls allow your applications to log users in, allow you to add new users, and allow users to manage their passwords.

Finally, I will apply what we have learned in this chapter to the bike blog application. With the addition of user security, the site can track who is logged in, allow entry of information that can be attributed to a particular user, and limit what a particular user can do on the site.