Best Practice for login systen with asp.net

[Erich]

Hello

I'm just wondering wich might be the best practice for realizing a login
system.

At the moment im having a object of self written type 'user' wich carrys
user data like name, email and a bool for 'loggedin'. I pass this object via
session.

This brings me to the point where if have at the very top of my aspx-site a
if-statement, wich returns a "Sorry, you are not logged in!" in case of
failed login and a very large else, wich contains the whole site, in case of
success.

Beside the way I did the securtiy aspect, I really dont like to have the
whole content in a: else { .. my whole site ... }

Is there a different way wich i just dont see?

Hope you get my point.

Thx so far!

yours erich

[Steve C. Orr [MVP, MCSD]]

Forms Authentication is your best bet.
It is easily configured in your web.config file.
Here's more information:
http://www.dotnetbips.com/displayarticle.aspx?id=9

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://SteveOrr.net
"Erich" <Er***@discussions.microsoft.com> wrote in message
news:BD**********************************@microsof t.com...

Hello

I'm just wondering wich might be the best practice for realizing a login
system.

At the moment im having a object of self written type 'user' wich carrys
user data like name, email and a bool for 'loggedin'. I pass this object
via
session.

This brings me to the point where if have at the very top of my aspx-site
a
if-statement, wich returns a "Sorry, you are not logged in!" in case of
failed login and a very large else, wich contains the whole site, in case
of
success.

Beside the way I did the securtiy aspect, I really dont like to have the
whole content in a: else { .. my whole site ... }

Is there a different way wich i just dont see?

Hope you get my point.

Thx so far!

yours erich

[Lucas Tam]

"=?Utf-8?B?RXJpY2g=?=" <Er***@discussions.microsoft.com> wrote in
news:BD**********************************@microsof t.com:

Beside the way I did the securtiy aspect, I really dont like to have the
whole content in a: else { .. my whole site ... }

Is there a different way wich i just dont see?

Forms Authentication... Login is already pretty much built for you in
ASP.NET : )

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[Erich]

Thank you!
Its not that I need to get a ready build application as soon as possible -
I`m just trying a bit with c# and asp.net.

So, Form Auth is something I`ll google for soon of course!
Beside that - if you werent using form auth, and would do it the old
fasioned way, would it be similar to my way?

"Lucas Tam" wrote:

"=?Utf-8?B?RXJpY2g=?=" <Er***@discussions.microsoft.com> wrote in
news:BD**********************************@microsof t.com:

Beside the way I did the securtiy aspect, I really dont like to have the
whole content in a: else { .. my whole site ... }

Is there a different way wich i just dont see?

Forms Authentication... Login is already pretty much built for you in
ASP.NET : )

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[Lucas Tam]

"=?Utf-8?B?RXJpY2g=?=" <Er***@discussions.microsoft.com> wrote in
news:5A**********************************@microsof t.com:

So, Form Auth is something I`ll google for soon of course!
Beside that - if you werent using form auth, and would do it the old
fasioned way, would it be similar to my way?

There is no reason to do it any other way but forms authentication. Forms
Authentication handles session management and page security... so you don't
have to worry about it yourself. Basically is is THE way to do it in
ASP.NET.

Forms Authentication can be modified to support a variety of login types
and is quite extensible.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/