How to create a basic user login using asp.net-mvc?

Question

I'm going to be building this from scratch with C# and asp.net on Entity/MVC frameworks using LINQ.

We've opted to not use the built in membership authorization.

What I am trying to figure out is if I have all my bases covered or if I am forgetting something. Or if I am over complicating it.

Here is how I envision it.

I create a table that will house the user info, username, password. Move that to a model in my code.

I create an Authentication service in my code. Then when they log in I add the time to the table they logged in, and then on each page visit I check that time and if 30 minutes have elapsed I log them out and put them back on the login page otherwise I bring them to the page they requested.

Is this an ok way to go about it? Do I really need to add an authentication check to each page controller?

Which would Basically be. Services.Authentication.VerifyLogin()

If 30 minutes have passed log them out update table LoggedIn to false. If within 30 minutes. Update the LoggedInTime to current time.

So every time they visit a page you will update the time in the db? So if they are on a page for more than 30mins they will be logged out? — Srb1313711
– Srb1313711, Commented Feb 20, 2014 at 17:25
"table that will house the user info, username, password" fail. There are certain categories of task that I would run away from. This is one of them. Just use the existing membership. Getting this stuff right is really really hard. Don't underestimate the task you're setting yourself. Make every effort to use an existing, tested framework. Rolling your own will almost certainly go wrong. — spender
– spender, Commented Feb 20, 2014 at 17:25
@spender Thanks for the advice spender, but lets focus on the actual question which stated I will not be using the built in membership. And as a side note where would I store the password if not in the database? — James Wilson
– James Wilson, Commented Feb 20, 2014 at 17:29

Community · Accepted Answer · 2017-05-23 12:10:55Z

2

I think what you want is to use an MVC authentication cookie, instead of checking your database for the time they logged in:

// sign in
FormsAuthentication.SetAuthCookie(username, false);
// sign out
FormsAuthentication.SignOut();

Ref. Custom Authentication and ASP.NET MVC

Ref. http://www.codeproject.com/Articles/578374/AplusBeginner-27splusTutorialplusonplusCustomplusF

Also, this is a good article on custom auth in MVC 4:

http://www.codeproject.com/Articles/601687/ASP-NET-MVC-4-Forms-Authentication-Customized

edited May 23, 2017 at 12:10

CommunityBot

11 silver badge

answered Feb 20, 2014 at 17:37

user1477388

21.5k35 gold badges152 silver badges277 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Pierre · Accepted Answer · 2014-02-20 17:37:03Z

0

If you're using MVC, you won't have to "add an authentication check to each page controller", all you have to do is adding the [Authorize] attribute above the Actions that need authentication in your controllers and that's about it.

Here's an Authorization sample that might help you out:
http://www.asp.net/mvc/tutorials/mvc-music-store/mvc-music-store-part-7

answered Feb 20, 2014 at 17:37

Pierre

4173 silver badges9 bronze badges

2 Comments

James Wilson Over a year ago

Thanks! Was hoping I would have to do it for every controller.

Pierre Over a year ago

You have the possibility to add it on the class level too.

Collectives™ on Stack Overflow

How to create a basic user login using asp.net-mvc?

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related