Security in ASP.NET

sanjibsinha · June 17th, 2010, 07:35 AM

Security is a very wide reaching term. With Membership and Roles Provider it can be tackled to some extent. But Authenticataion and Authorization also plays a vital Role. Which one is prefrred and why?

Imar · June 23rd, 2010, 02:38 AM

What exactly are you asking? When referring to authentication and authorization, you typically can't use one without the other.....

Imar

sanjibsinha · June 24th, 2010, 08:39 AM

Many thanks Imar, actually I wanted to say, if I decide to use Membership or Role Providers beforehand, then are Authentication and Authorization neccessary in web.config?
I want to clarify it a little bit.
The different authentication modes are established through settings that can be applied to the applicationâs web.config file but the same effect can be made by using Membership or Role providers.

But, suppose, I beforehand used Membership and Role providers and later in my Administrator or Member's Page_Load event use code like this

Code:

if (User.IsAuthenticated)
{
//code goes here...
}
else
Server.Transfer(....);

In this way I can resist general users not to enter restricted pages without using Authentication or Authorization.
Now my question : Is it a good practice or I should always use Authentication or Authorization?

Imar · June 24th, 2010, 08:56 AM

I am not sure what you mean with "using Authentication or Authorization". These are not technolgies, but concepts. You can implement authentication or authorization with the Membership and Role services. With these two services enabled you can write code similar to what you posted here. Personally, I would protect the entire page with URL Authorization rather than programmatically.

Cheers,

Imar

sanjibsinha · June 25th, 2010, 09:00 AM

I've just read the chapter of Security(Page 579) from your book "Beginning
ASP.NE T 4 in C# and VB".
To quote from your book :
"ASP.NET 4 ships with a number of application services, of which the most important ones are:
Membership: Enables you to manage and work with user accounts in your system.
Roles: Enables you to manage the roles that your users can be assigned to.
Profile: Enables you to store user-specific data in a back-end database."
Actually it was my fault in understanding. Anyway I got the answer. Many thanks Imar.