I have my reasons not to use the ASP.NET membership. Though this causes me some issues. I read about a thousand articles on ASP.NET MVC custom authentication and I've found that almost all of them are just too simple to be of any use.
What I need is a good way to login a user, keep some info about him securely in a cookie (info such as id, username, email and role) and later use this info to assure that he's authorized to visit and edit certain pages. The way I have things right now is a bit convoluted and possibly insecure.
Here's the relevant code in my login method:
// Set session cookie
var cookieName = CookieHelper.MergeIntoString(user.Id, user.Username, user.IsAdmin, user.IsStaff);
// Code for the CookieHelper class is to follow below!
var timeout = model.RememberMe ? 525600 : 2880; // 365 days or 2 days
var ticket = new FormsAuthenticationTicket(cookieName, model.RememberMe, timeout);
var encrypted = FormsAuthentication.Encrypt(ticket);
var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted)
{
Expires = DateTime.Now.AddMinutes(timeout),
HttpOnly = true
};
Response.SetCookie(cookie);
Code for the CookieHelper
class:
public static class CookieHelper
{
public static string MergeIntoString(int id, string username, bool isAdmin, bool isStaff)
{
return id + "/" + username + "/" + isAdmin + "/" + isStaff;
}
public static Dictionary<string, object> DecodeFromString(string cookieName)
{
var cookieDictionary = new Dictionary<string, object>();
var cookieArray = cookieName.Split('/');
cookieDictionary.Add("Id", cookieArray[0]);
cookieDictionary.Add("Username", cookieArray[1]);
cookieDictionary.Add("IsAdmin", cookieArray[2]);
cookieDictionary.Add("IsStaff", cookieArray[3]);
return cookieDictionary;
}
}
Why am I using the CookieHelper
class? Because I have no idea how to add more information that will be encrypted in my cookie. So I decided to put the info into the cookie name string and later split it to get my info.
And this is how I later reach into the cookie to get the user id:
var authCookie = HttpContext.Request.Cookies[FormsAuthentication.FormsCookieName].Value;
if (authCookie == null)
return RedirectToAction("Index", "Home");
var cookieName = FormsAuthentication.Decrypt(authCookie).Name;
var cookie = CookieHelper.DecodeFromString(cookieName);
var userId = Convert.ToInt32(cookie["Id"]);
Now I'm sure there's thousands of issues with this. Can you tell me of a better way of doing what I'm trying to do?