Key concepts in this chapter are:
Adding a secure section to a Web site
Using Forms authentication
Using Windows authentication
Using Passport authentication
Perhaps you write your Web applications in a darkened room mumbling
If you’re still reading, you probably have a real-world Web application either deployed on the Internet or a company intranet. The same security challenges apply to both Internet and intranet Web applications. In both cases, you never know who will try to use your application and what their intentions are— for example, some might use your application for
In ASP.NET applications, you can specify that all or part of a site is secured, and that it is accessible only to authenticated users. In this case, authentication is automatic88—if the
|
None |
No authentication. All resources in the Web site are available to the anonymous user. This is the default.* |
|
Forms |
Forms-based authentication. The first time the user
|
|
Windows |
Windows integrated security. The first time the user navigates to a secure page, ASP.NET checks the user account used to log in to Windows. This option is very easy to implement and makes the authentication process invisible to the user. It’s a great option for intranet Web applications, but it’s usually not practical for public Web sites. |
|
Passport |
Microsoft .NET Passport security. The first time the user navigates to a secure page, ASP.NET redirects him to the Microsoft .NET Passport login site. The user will use his .NET Passport to log in to your system. This is a good option for public Web sites because your users are spared from creating yet another username and password. It also moves the task of managing usernames and passwords from your site to Microsoft .NET Passport ( http://www.passport.net/ ). However, of the four types of authentication, this takes the most effort to implement. |
|
*The default is actually Windows authentication with anonymous authorization. The net result of this combination is no authentication. |
|
After your site has authenticated that the user is who he says he is, it can also restrict areas of the site to selected users or roles. This type of security is called authorization, and the concept as it applies to ASP.NET applications was covered in Chapter 2. In this chapter, you’ll use Forms authentication to secure a Web site that allows users to edit and view information in the EmployeeData.mdb database, and you’ll also learn how to use Windows and Passport authentication. For simplicity, all examples in this chapter assume the Web server is also your development machine, which is also the machine you are using to test the applications. Also for simplicity, the examples in this chapter assume you are using Microsoft Internet Explorer 5.5 or later on Microsoft Windows XP. (All these authentication techniques are also available to Netscape products—except Windows authentication, which requires Internet Explorer.)