Enhancing Website Security with Membership Provider in Asp.Net

All of the websites are available whenever you connect to the internet, this is the ideal scenario for web world, but sometimes it isn’t always an appropriate design choice. Let’s take an example of an e-commerce website, where you need to provide a secure way for your customers to complete monetary transactions, or at subscription based sites that need to restrict people who haven’t paid a fee for that subscription. Even a public website may provide some features or services which shouldn’t be available for particular users. All of these examples require a security model, which conducts the proper security for the web application. Every development language provides a security model. Here we are talking about the ASP.NET platform for understanding the need of the authentication and authorization for the particular websites and implementing it with the help of Membership Class.  

The first step in implementation of security for a web application is understanding the security requirements. It is the crucial part because it is not a good strategy to build the same security model throughout the application whether the application needs it or not. Security doesn’t need to be complex but should be multilayered enough to protect user's privacy. 

Original Article found here

Membership is a layer of security model, provided by Microsoft in asp.net, which provides features of mainly three categories: 1) User Record Management – while using Membership features in ASP.NET, you don’t need to create any database for handling security purpose, instead of it; asp.net creates one for you and maintains catalogs of user information. 2) Security controls – Membership has its own security controls such as login, forgot password, create new user etc. so you need to design these control for your websites. 3) Role based security – Membership supports roles that mean you can provide different permissions to different types of people in the same application. Before continuing any further implementing Membership in your asp.net website you need to set authentication of application to ‘Forms’. Here is the code you can use to do so –

<system.web>  <authentication mode="Forms" /> </system.web> 

Now if you have decided to use Membership in your application, you need to create a database for the Membership, but if you are using SQL Server 2005 or higher version then you need not to do anything, your application will create a Membership Database for you inside the ‘App_Data’ subfolder of your website having name – ‘aspnetdb.mdf’. The default Connection String used by Membership is ‘LocalSqlServer’ which can be configured in ‘web.config’ file as follows –

<connectionStrings>  

    <clear />  

    <add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS; Integrated Security=SSPI; initial catalog=aspnetdb" /> 

</connectionStrings> 

Now you need to configure Membership Provider in ‘web.config’ file to use its classes as follows –

<system.web> 

<membership defaultProvider="MyMembershipProvider">  

     <providers>  

         <add name="MyMembershipProvider" 

          connectionStringName="LocalSqlServer" 

          applicationName="MyMembership" 

          enablePasswordRetrieval="false" 

          enablePasswordReset="true" 

          requiresQuestionAndAnswer="true" 

          requiresUniqueEmail="true" 

          passwordFormat="Hashed" 

          type="System.Web.Security.SqlMembershipProvider" />  

     </providers> 

</system.web> 

Within the <membership> section, you can add multiple providers as child elements of the ‘<providers>’ section. In the previous code, you can see a valid configuration for the included ‘SqlMembershipProvider’. It’s important not to forget about the ‘defaultProvider’ attribute on the ‘<membership>’ element. This attribute indicates the membership provider that your application will use. Configured providers are shown in the ASP.NET web configuration when selecting the option Select a Different Provider for Each Feature in the provider configuration. Following is a table which describes the attributes of Membership Provider:

Membership Classes

Retrieving Users from the Store

To retrieve a single user and a list of users through the Membership class from the membership store. You just need to create a simple page with a GridView control for binding the users to the grid, as follows:

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>Retrieve Users</title>
</head>
<body>
 <form id="form1" runat="server">
    <div>
        <asp:GridView ID="UsersGridView" runat="server"
                      DataKeyNames="UserName"
                      AutoGenerateColumns="False">
            <Columns>
                <asp:BoundField DataField="UserName" HeaderText="Username" />
                <asp:BoundField DataField="Email" HeaderText="Email" />
                <asp:BoundField DataField="CreationDate"
                                HeaderText="Creation Date" />
                <asp:CommandField ShowSelectButton="True" />
            </Columns>
        </asp:GridView>
        </div>
    </form>
</body>
</html>

You can now add the following code to the ‘Page_Load’ event procedure for loading the users from the membership store and binding them to the grid:

public partial class _Default : System.Web.UI.Page 

{ 

     MembershipUserCollection _MyUsers; 

     protected void Page_Load(object sender, EventArgs e) 

     { 

          MyUsers = Membership.GetAllUsers(); 

          UsersGridView.DataSource = _MyUsers; 

          if (!this.IsPostBack) 

          { 

               UsersGridView.DataBind(); 

          } 

      } 

} 

Creating and Deleting Users

Creating users is as simple as using the rest of the membership API. You can create users by just calling the ‘CreateUser’ method of the Membership class. Therefore, if you want to add the feature of creating users to your website, you can add a new page containing the necessary text boxes for entering the required information, then add a button, and finally handle the Click event of this button with the following code:

protected void ActionAddUser_Click(object sender, EventArgs e) 

{ 

    try 

    { 

         MembershipCreateStatus Status; 

         Membership.CreateUser(txtUserName.Text, txtPassword.Text, txtUserEmail.Text, txtPwdQuestion.Text, txtPwdAnswer.Text, true, out Status); 

         StatusLabel.Text = "User created successfully!";

    } 

    catch(Exception ex) 

    { 

         Debug.WriteLine("Exception: " + ex.Message); 

         StatusLabel.Text = "Unable to create user!"; 

    } 

} 

Validating Users

Last but not least, the Membership class provides a method for validating a membership user. If a user has entered his user name and password in a login mask, you can use the ‘ValidateUser()’ method for programmatically validating the information entered by the user, as follows:

 
if (Membership.ValidateUser(txtUserName.Text, txtPassword.Text)) 

{ 

      FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false); 

} 

else { // Invalid user name or password message. }