Account Creation and Security

[farsad nasseri]

Hi

I'm trying to design a web application where people can create user Ids and
passwords while signing up and then use that information to login to an
account. (I know, very basic). I just can't get my mind around how to make
this system most secure. the user id and password is verified at the time of
logging in and at that point, I would like to create something like a session
key before openning the new page. I basically don't want to start the new
page by passing regular parameters through the URL because that's very easy
to manipulate and break. Can someone give me some information about creating
a secure system like this and/or forward me some useful sources?? btw.. I'm
using, IIS as my server, ASP.Net and VB.Net.

Thanks

Farsad

[Curt]

Farsad,

You should consider employing form authentication. Google the
FormsAuthentication object, there is a extensive information on the web for
this.

I use both FormsAuthentication.SetAuthCookie and
FormsAuthentication.RedirectFromLoginPage methods on different applications.
With forms authentication, you designate a page that is accessible to all
users. Until the user is authenticated, he cannot access other pages in the
application.

I hope this helps, good luck!
Curt

"farsad nasseri" <fa***********@discussions.microsoft.com> wrote in message
news:DF**********************************@microsof t.com...

Hi

I'm trying to design a web application where people can create user Ids
and
passwords while signing up and then use that information to login to an
account. (I know, very basic). I just can't get my mind around how to make
this system most secure. the user id and password is verified at the time
of
logging in and at that point, I would like to create something like a
session
key before openning the new page. I basically don't want to start the new
page by passing regular parameters through the URL because that's very
easy
to manipulate and break. Can someone give me some information about
creating
a secure system like this and/or forward me some useful sources?? btw..
I'm
using, IIS as my server, ASP.Net and VB.Net.

Thanks

Farsad

[John Rivers]

If security is really an issue you should consider using SSL
that is about the only way to protect session hijacking etc.

NTLM is also pretty good but managing the accounts can be
a pain

a nice solution is to use your own basic authentication over ssl
this allows you to manage and use the user database as you wish
whilst skipping getting involved in windows authentication
and letting users login using the login prompt in browsers and save
their passwords if they wish, plus you get to use the realm parameter
to say something cool !

all you need to do it is read up on www-authenticate header and base64
encoding
this also allows for "roaming web sessions" - where one of your
customers can
login at home and then later at work and still be in the same session
(ie: his
shopping basket has the same products in as at home)

it is the slickest solution outside of ntlm