18

What are some of the common methods to do simple user validation (account login)?

Also, can you have different authentication schemes per area?

Edit

I am creating an eCommerce site that will need to have protected actions per user. So how would one go about doing this? It will need to be able to let only authenticated users access their information.

Sam
  • 15,336
  • 25
  • 85
  • 148
  • Why inventing the wheel then? start from a good base platform for a ECommerce site, if you're in .NET, start with http://www.nopcommerce.com/ it's an ASP.NET 4.0 solution. – balexandre Mar 28 '11 at 19:47

3 Answers3

29

You have several options when it comes to doing authentication in MVC:

The built in Forms Authentication can allow you to limit access to different areas of your application based on Role, User among other things and it is quite easy to implement using the [Authorize] attribute.

The following would require the user be logged in:

[Authorize]
public ActionResult YourActionNameGoesHere()
{
}

Likewise, the following would require the user be logged in AND be an Administrator:

[Authorize(Roles="Administrator")]
public ActionResult YourActionNameGoesHere()
{
}

Those were just a few methods of accomplishing it, as you can see there are MANY different methods of accomplishing this - I hope this might have shed a bit of light in helping you decide.

Community
  • 1
  • 1
Rion Williams
  • 74,820
  • 37
  • 200
  • 327
  • Levi, the security expert on the MVC team, states that there is only one secure way to perform authentication. See my answer. – Eric J. Feb 23 '12 at 04:54
8

According to the security expert on the MVC team

The only supported way of securing your MVC application is to have a base class with an [Authorize] attribute, and then to have each controller type subclass that base type. Any other way will open a security hole.

http://blogs.msdn.com/b/rickandy/archive/2011/05/02/securing-your-asp-net-mvc-3-application.aspx

Eric J.
  • 147,927
  • 63
  • 340
  • 553
3

please go to your model folder when you create a internet application with VS 2010. you will see a cs file there. that file holds a sample structure for User Authentication

Remember that : ASP.NET MVC is not a separate framework. it sits on top of ASP.NET so you can use System.Web.Security.Membership class on MVC as well.

Also, check your Account folder inside your view folder. you will some view samples there.

hope this helps.

tugberk
  • 57,477
  • 67
  • 243
  • 335