Best option to custom Authentication using ASP .NET MVC (Cache, Cookie...)

Question

I am a bit lost using Authentication with MVC...

I´m looking for the best option to use in a big E-Commerce site, where the performance is top priority...

The two options I´m looking until now are :

Create a FormsAuthenticationTicket and encrypt it into a cookie, like implemented here : Cookie implementation

Cache the Authentication data, like that :

protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
    if (HttpContext.Current.User != null)
    {
        if (HttpContext.Current.User.Identity.IsAuthenticated)
        {
            if (HttpContext.Current.User.Identity is FormsIdentity)
            {
                // Get Forms Identity From Current User
                FormsIdentity id = FormsIdentity)HttpContext.Current.User.Identity;
                // Create a custom Principal Instance and assign to Current User (with caching)
                Customer principal = (Customer)HttpContext.Current.Cache.Get(id.Name);
                if (principal == null)
                {
                    // Create and populate your Principal object with the needed data and Roles.
                    principal = MyBusinessLayerSecurityClass.CreatePrincipal(id, id.Name);                            
                    HttpContext.Current.Cache.Add(
                    id.Name,
                    principal,
                    null,
                    System.Web.Caching.Cache.NoAbsoluteExpiration,
                    new TimeSpan(0, 30, 0),
                    System.Web.Caching.CacheItemPriority.Default,
                    null);
                }
                HttpContext.Current.User = principal;
            }
        }
    }
}

Caching sample here

What you guys think?

Thanks

Darin Dimitrov · Accepted Answer · 2010-11-18 12:20:20Z

4

A more MVCish way to achieve this is to write a custom AuthorizeAttribute and perform this in an overriden OnAuthorization method instead of using Application_AuthenticateRequest.

This being said I think that your implementation is quite good. As an alternative of storing the additional information into the cache you could store it in the userData part of the authentication ticket if this information is not very large of course. Both approaches are viable. If you decide to go with caching I would recommend you offloading it to dedicated cache servers instead of storing it in the memory of the web servers.

edited Nov 18, 2010 at 12:20

answered Nov 18, 2010 at 12:14

Darin Dimitrov

1.0m276 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Best option to custom Authentication using ASP .NET MVC (Cache, Cookie...)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related