Basic safe sessions in ASP .Net?

Question

First off, I am not using Forms Authentication.

The only problem is that it does not seem like a good idea. It stores the username in the cookie. That seems very bad.

How could I do something like this tutorial but in a safe way?

I essentially just want this basic flow:

if user logged in then show page

User can have the option of being logged in for the session (30 mins of inactivity) or until they choose to explicitly logout.

I have a feeling I will need a session table in my db for this, but I am not sure.

It doesn't have to be top of the line security since this is for an intranet, but I do still want it to be somewhat safe.

Thanks

Also, you have yet to "accept" an answer on any of your previous 8 questions. You should look into that. — MikeSmithDev, Feb 07 '13 at 14:42

score 1 · Accepted Answer · edited May 23 '17 at 12:12

1

Easiest way is in your Login function, once you have verified them just add:

FormsAuthentication.SetAuthCookie(theUserName, persistCookieBoolean);

Now you have an authentication cookie set. No encrypting or decrypting needed. Get the username like:

HttpContext.Current.User.Identity.Name

And see if they are logged in:

HttpContext.Current.User.Identity.IsAuthenticated

And now you can set authorization easily in the web.config too. Related post: Manual Access control in ASP .Net

edited May 23 '17 at 12:12

Community

answered Feb 07 '13 at 14:35

MikeSmithDev

I cannot seem to access HttpContext.Current.Request.LogonUserIdentity.Name. I tried in my page load but I get an error. – user2043533 Feb 07 '13 at 15:04
What does `HttpContext.Current.User.Identity.Name` return tho? [LogonUserIdentity](http://msdn.microsoft.com/en-us/library/system.web.httprequest.logonuseridentity.aspx) != [User.Identity.Name](http://msdn.microsoft.com/en-us/library/system.web.httpcontext.user.aspx) – MikeSmithDev Feb 07 '13 at 15:10

score 0 · Answer 2 · edited May 23 '17 at 12:27

0

Encrypt your data (username, etc) before storing in the cookie.

Read the cookie, decrypt the data & then validate.

Check this:

edited May 23 '17 at 12:27

Community

answered Feb 07 '13 at 14:25

Kapil Khandelwal

score 0 · Answer 3 · answered Feb 07 '13 at 15:09

You can use Sessions.

Example Code VB:

On login do:

Session("Username") = "username"

Then each time on page load check if Session("Username") has any data/is not null.

If it's null or empty then the Session has expired and you can kick them out of the page.

3 Answers3