ASP.NET custom forms authentication - Part I

Forms authentication is generally used in internet facing applications. ASP.NET provides easy to use Membership Providers, Role providers etc. But some times we do need to right custom authentication code. That is what we are going to discuss today.


Let us start with points to be considered:  
Note: I am going to use cookie for state management.


We need cookie for forms authentication.
We need cookie for session management.
We need to clear and abandon the session on logout. 
We need to clear authentication ticket too.


Web.config
Here we have set the name for the authentication cookie. We have set the loginUrl - URL of the login page. We have set a defaultUrl - URL of the page where the user will be re-directed after login.


for other attributes please visit this MSDN page.


Authentication
On (say) login button click write this code


    protected void btnLogin_Click(object sender, EventArgs e)
    {  
         if(Valid(userid,password))
         {
             if (Request.QueryString["ReturnUrl"] != null)
      {
        FormsAuthentication.RedirectFromLoginPage(UserID, false);
      }
      else
      {
        FormsAuthentication.SetAuthCookie(UserID, false);
        Response.Redirect("~/Pages/Home.aspx");
      }
         }
         else
         {
            Do something....
          }
    }


Here Valid() is the custom function which validates the user. UserID has been passed RedirectFromLoginPage and SetAuthCookie functions as this will be used to set the user in context.


LoginStatus control (for logout)
protected void UserLoginStatus_LoggingOut(object sender, LoginCancelEventArgs e)
{        
  Session.Clear();
  Session.Abandon();
  FormsAuthentication.SignOut();
}


In the next part we will look deeper into this. This post was just to get the work done :D. ( Next Article - Part 2)


Hope this will be helpful. Happy Coding!!!