Developing Secure Web Site with ASP.NET and IIS: PartII

<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl = "login.aspx">
</forms>
</authentication>
</system.web>
</configuration>

The authentication mode is set to Form and login Url attribute set to login.aspx file. This allows access to all users to the root directory.

Login.aspx file

This is the page that a user will be redirected if their request doesnt contain an authentication ticket. This file name is specified in web.config file and its located at the public area that every one can access. The user will enter their username and password and click Login button. The pass word entered by the user will be hashed by FormsAuthentication.HashPasswordForStoringInConfigFile method before comparing to stored password in XML file.

The password that stored in XML file will be encrypted using above method. This is not the perfect encryption mechanism, because this method is vulnerable to a dictionary attack. User should select non common words with numbers and non alphabetic characters to help prevent dictionary attack. At the same time we can apply Access Control List (ACL) permission to the file, so that only authorized users can read it.

If the user name and password is equal to the XML file details, user will be redirected to the Default.aspx page. Otherwise an error message will be displayed at login.aspx page. The user.xml and Default.aspx pages are located at the private area as protected resources.

The following source code demonstrates the login procedure. First the application will read the user.xml file to a DataSet. Then that information will fill in to a DataTable. The DataTable information will then filtered using Select method to identify whether table contains the input username. If the application match any records, that will be loaded to a DataRow. If not, this user is not a registered user and has to register and try again. For a matched record the input password will hashed and compare against the stored hashed password. If the passwords matched, the user will be redirected to the protected recourses. Otherwise an error message will display at login.aspx page.

private void loginDetails()
{
String filter = "UserName='" + txUserName.Text + "'";
string fileName = "/Details/users.xml";
//Create a DataSet
DataSet loginDS = new DataSet();
bool CookieValue = false;
//Select Persistent Cookie or not
if(pCookie.Checked)
{
CookieValue = true;
}
else
{
CookieValue = false;
}
//Create FileStream to read the users.xml file
FileStream loginFileStream = new
FileStream("C:\\Inetpub\\wwwroot\\FormAuthentication2"
+fileName,FileMode.Open,FileAccess.Read);
//Create StreamReader
StreamReader reader = new StreamReader(loginFileStream);
//Read the xml file to DataSet
loginDS.ReadXml(reader);
loginFileStream.Close();
//Get the data to a DataTable from the DataSet
DataTable usersDetails = loginDS.Tables[0];
//Filter the data to a DataRow from the DataTable
DataRow[] matcheUsers = usersDetails.Select(filter);
//If username is found
if( matcheUsers != null && matcheUsers.Length > 0 )
{
DataRow userRow = matcheUsers[0];
//Encrypt the provided password
string hashedPassword = FormsAuthentication.HashPasswordForStoringInConfigFile(txPassword.Text, "sha1");
//Read password from xml file
string XMLpassword = userRow["UserPassword"].ToString();
//Check if stored password and provided password are equal
if( 0 != String.Compare(XMLpassword, hashedPassword, false) )
{
//If not equals, display error message
Label3.Text = "Invalid Credentials: Please try again";
}
else
{
//If equals, Redirect to protected resource
FormsAuthentication.RedirectFromLoginPage(txUserName.Text, CookieValue);
}
}
else
{
Label3.Text = "You are not a registered user. Please register and try again";
}
}

If the Persistent Cookie check box is selected, the cookie will be valid across browser sessions. Otherwise, the generated cookie will be destroyed when the browser is closed.

The new users can register them self using Register button. The new user will input the username and password and click Register button. The password will be then encrypted using FormsAuthentication.HashPasswordForStoringInConfigFile method before it is saved to the users.xml file. This provide more secure environment than simply keeping the password as human readable text.

private void register()
{
try
{
string fileName = "/Details/users.xml";
//Create a DataSet
DataSet userDS = new DataSet();
//Create new FileStream
FileStream userFileStream = new
FileStream("C:\\Inetpub\\wwwroot\\FormAuthentication2" +fileName,FileMode.Open,FileAccess.Read);
//Create new StreamReader
StreamReader reader = new StreamReader(userFileStream);
//Read the xml file to DataSet
userDS.ReadXml(reader);
userFileStream.Close();
//Encrypt the provided password
string hashedPassword=
FormsAuthentication.HashPasswordForStoringInConfigFile(txPassword.Text, "sha1");
//Create A new DataRow
DataRow newUser = userDS.Tables[0].NewRow();
//Add username to DataRow
newUser["UserName"] = txUserName.Text;
//Add hashed Password to DataRow
newUser["UserPassword"] = hashedPassword;
//Add the new DataRow to DataTable
userDS.Tables[0].Rows.Add(newUser);
//Update the DataSet with new information
userDS.AcceptChanges();
//Create new FileStream
FileStream addUserFileStream = new
FileStream("C:\\Inetpub\\wwwroot\\FormAuthentication2"+fileName, FileMode.Create,FileAccess.Write|FileAccess.Read);
//Create new StreamWriter
StreamWriter writer = new StreamWriter(addUserFileStream);
//Write DataSet data to XML file
userDS.WriteXml(writer);
//Close StreamWriter
writer.Close();
//Close FileStream
addUserFileStream.Close();
Label3.Text = "Your registration was successful, Please login";
}
catch(Exception e)
{
Label3.Text = "Error: " + e.Message.ToString();
}
}

Now lets look at protected level directory and files. Protected level directory contains web.config, user.xml and Default.aspx pages.

Web.config file

The web.config file should configure as below. This will simply deny access for all unauthorized users.

<configuration>
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web >
</configuration>

user.xml file

This contains all the valid usernames and passwords. The passwords are encrypted using FormsAuthentication.HashPasswordForStoringInConfigFile method. As you can see the password is a long string of alphabetical and numeric characters.

<Users>
<Users>
<UserName>gayan</UserName> <UserPassword>134B20FFF068BEBD6014C15D1BF2F3BEC3FDC8A6</UserPassword>
</Users>
</Users>

Default.aspx file

This is the protected resource. This file simply displays the username of the user and contains a button to sign-out.

//page Load event
private void Page_Load(object sender, System.EventArgs e)
{
//Display the username
Label1.Text = "Hello, " + Context.User.Identity.Name;
}
//Sign-out button click
private void btSignOut_Click(object sender, System.EventArgs e)
{
//Sing-out and redirect to login.aspx page
FormsAuthentication.SignOut();
Response.Redirect("login.aspx");
}

At the same time usernames and passwords can be stored in an Access Database or in a SQL Server database. The storing mechanism will be depending on the scalability of your application and number of users you need to support.

Conclusion

I hope above details will help you to understand the ASP.NET Form Authentication mechanism. Its only just a drop of the whole ocean of ASP.NET security.