Better way for authentication in asp.net mvc

Question

I know two way for authentication: first: using FormsAuthentication:

FormsAuthentication.SetAuthCookie(login.UserName, login.RememberMe);

and the other way : using FormsAuthenticationTicket

  var ticket = new FormsAuthenticationTicket(1, user.Email.ToString(), DateTime.Now, DateTime.Now.AddSeconds(300000), login.RememberMe, "a");
                var ticketEncrypted = FormsAuthentication.Encrypt(ticket);
                var cookie = new HttpCookie("eshop", ticketEncrypted);
                if (login.RememberMe)
                {
                    cookie.Expires = DateTime.Now.AddMinutes(100);
                }
                HttpContext.Response.Cookies.Add(cookie);

i want to know which one is better? and when i should use first one and when the other way?

suggest changing the title of your post to something that better reflects what you're asking — wal
– wal, Commented Jun 10, 2016 at 7:48

wal · Accepted Answer · 2016-06-10 07:36:06Z

3

The first method also uses FormsAuthenticationTicket - follow the source code to FormsAuthentication.GetAuthCookie and you can see

FormsAuthenticationTicket ticket = FormsAuthenticationTicket.FromUtc(2, userName, utcNow, expirationUtc, createPersistentCookie, string.Empty, strCookiePath);
string str = FormsAuthentication.Encrypt(ticket, hexEncodedTicket);

i.e. starting to look similar to your second code sample

Unless you are using cookieless auth then both are doing effectively the same thing i.e. setting a cookie in the browser

You might use the latter if you wanted finer control over what attributes the cookie has.

answered Jun 10, 2016 at 7:36

wal

17.8k8 gold badges80 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

pmn Over a year ago

are you mean both ways are same, and first way just encapsulate second way?

wal Over a year ago

what i'm saying is that under certain conditions they will lead to the same result. the former has the ability to do cookieless which is entirely different to using cookies but assuming you DO use cookies (which most do) then yes the former encapsulates the latter (maybe not exactly as you wrote in your sample but it has the potential)

Collectives™ on Stack Overflow

Better way for authentication in asp.net mvc

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related