[Global]Reported Post by Terrankiller

Terrankiller · Sep 14, 2011

Terrankiller has reported a post.

Reason:

Advertisement.
Click to expand...

Post: Security in ASP.NET
Forum: Web Programming
Assigned Moderators: N/A

Posted by: ravbop1
Original Content:

Security in ASP.NET

Authentication and Authorization

Two concepts form the basis of any discussion about security:

Authentication: This is the process of determining a userâ€™s identity and forcing users to
prove they are who they claim to be. Usually, this involves entering credentials (typically a
user name and password) into some sort of login page or window. These credentials are
then authenticated against the Windows user accounts on a computer, a list of users in a
file, or a back-end database.

Authorization: Once a user is authenticated, authorization is the process of determining
whether that user has sufficient permissions to perform a given action (such as viewing a
page or retrieving information from a database). Windows imposes some authorization
checks (for example, when you open a file), but your code will probably want to impose
its own checks (for example, when a user performs a task in your web application such as
submitting an order, assigning a project, or giving a promotion).

Authentication and authorization are the two cornerstones of creating a secure userbased
site. The Windows operating system provides a good analogy. When you first boot up
your computer, you supply a user ID and password, thereby authenticating yourself to the
system. After that point, every time you interact with a restricted resource (such as a file, database,
registry key, and so on), Windows quietly performs authorization checks to ensure your
user account has the necessary rights.

You can use two types of authentication to secure an ASP.NET website:

Forms authentication: With forms authentication, IIS is configured to allow anonymous
users (which is its default setting). However, you use ASP.NETâ€™s forms authentication
model to secure parts of your site. This allows you to create a subscription site or
e-commerce store. You can manage the login process easily, and write your own login
code for authenticating users against a database or simple user account list.

Windows authentication: With Windows authentication, IIS forces every user to log in as a
Windows user. (Depending on the specific configuration you use, this login process may
take place automatically, as it does in the Visual Studio test web server, or it may require
that the user type a name and password into a Login dialog box.) This system requires
that all users have Windows user accounts on the server (although users could share
accounts). This scenario is poorly suited for a public web application but is often ideal
with an intranet or company-specific site designed to provide resources for a limited set
of users.

One more authentication technique is Passport Authentication which is used under
national/international provisions and not in general or commercial websites.

more information at Cegonsoft
Click to expand...

Log in or Sign up

[Global]Reported Post by Terrankiller

Terrankiller Ex-Administrator

Log in or Sign up

[Global]Reported Post by Terrankiller

Thread Tools

Terrankiller Ex-Administrator