Introduction
In this article we will learn Form Authentication and Form Authorization and how to store encrypted values into a SQL database.
Basically Forms Authentication is used for internet web applications where the user does not need to be a member of a domain-based network to have access to any application, websites like gmail.com, facebook.com, twitter.com and so on uses forms authentication because to use these internet applications you do not need to be a member of their domain based network.
Whereas Authorization is the process of determining whether or not an authenticated user has permission to access a specific area of an application.
For example, within our application we'll want to authorize that only users who are logged in can access the Welcome Page.
Let's Start.
- Create a new project, name it whatever you want to.
- Create three Web Forms and name them as:
-
Designing the pages
Open the Login.aspx page and design it like this:
Code:
- <html xmlns="http://www.w3.org/1999/xhtml">
- <head runat="server">
- <title></title>
- </head>
- <body>
- <form id="form1" runat="server">
- <div>
- <fieldset>
- < legend>Login</legend>
-
- <table>
- <tr>
- <td>
- <asp:Label ID="lbl_UserName" runat="server" Text="User Name"></asp:Label>
- </td>
- <td>
- <asp:TextBox ID="tb_UserName" runat="server"></asp:TextBox>
- </td>
- </tr>
-
- <tr>
- <td>
- <asp:Label ID="lbl_Password" runat="server" Text="Password"> </asp:Label>
- </td>
- <td>
- <asp:TextBox ID="tb_Password" runat="server"></asp:TextBox>
- </td>
- </tr>
-
- <tr>
- <td colspan="2">
- <asp:Button ID="btn_Login" runat="server" Text="Login" />
- </td>
- </tr>
-
- <tr>
- <td colspan="2">
- <asp:Label ID="lbl_Message" runat="server" ForeColor="Red"></asp:Label>
- </td>
- </tr>
-
- <tr>
- <td colspan="2">
- <a href="Registration/Register.aspx"> Click here to register</a> if you do not have a user name and password
- </td>
- </tr>
-
- </table>
- </fieldset>
- < /div>
- </form>
- </body>
- </html>
Open the Register.aspx page and design it like this:
Code:
- <html xmlns="http://www.w3.org/1999/xhtml">
- <head runat="server">
- <title></title>
- </head>
- <body>
- <form id="form1" runat="server">
- <div>
- Registration Page
- </div>
- </form>
- </body>
- </html>
Open the Welcome.aspx page and design it like this:
Code:
- <html xmlns="http://www.w3.org/1999/xhtml">
- <head runat="server">
- <title></title>
- </head>
- <body>
- <form id="form1" runat="server">
- <div>
- <h1>Welcome</h1>
- </div>
- </form>
- </body>
- </html>
Currently a user can easily navigate to any page without using their user name and password just by editing the URL:
-
Implementing Form Authentication
But now we will use a Forms Authentication technique by which only the valid user will be allowed to view other parts of the application.
To enable Forms Authentication, within the Web.config file use the authentication element <authentication mode=”forms”>.
Add this code to Web.config file:
Code:
- <system.web>
- <compilation debug="true" targetFramework="4.0" />
-
- <authentication mode="Forms">
- <forms loginUrl="Login.aspx" defaultUrl="Welcome.aspx">
- <credentials passwordFormat="Clear">
- <user name="jsb" password="jsb"/>
- <user name="abc" password="abc"/>
- </credentials>
- </forms>
- </authentication>
-
- <authorization>
- <deny users="?"/>
- </authorization>
-
- </system.web>
The wildcard ? represents unauthenticated users while * represents all users.
Open the Login.aspx page in designer mode then double-click on the Login button and add the following code.
Code:
- using System.Web.Security;
-
- protected void btn_Login_Click(object sender, EventArgs e)
- {
- if( FormsAuthentication.Authenticate(tb_UserName.Text, tb_Password.Text))
- {
- FormsAuthentication.RedirectFromLoginPage(tb_UserName.Text, false);
- }
- else
- {
- lbl_Message.Text="Invalid User Name or Password";
- }
- }
Make a change in the Web.config file from:
- <forms loginUrl="Login.aspx">
To:
- <forms loginUrl="Login.aspx" defaultUrl="Welcome.aspx">
Run the project , enter User Name and Password, click on Login.
-
Imlementing Form Authorization
By doing the preceding stuff, we are not able to navigate to the Registration/Register.aspx page if we are not logged in.
To solve this issue we will be using another Web.config file to the registration folder and specify the authorization element to allow all the users.
Code:
- <system.web>
- <authorization>
- <allow users=”*”/>
- </authorization>
- </system.web>
In your Solution Explorer right-click on the Registration Folder and add a new item as in the following:
Once you hit Add you will see a new Web.config file in your project as in the following:
Add this code to this Web.config file.
Code:
- <?xml version="1.0"?>
- <configuration>
- <system.web>
- <authorization>
- <allow users="*"/>
- </authorization>
- </system.web>
- </configuration>
Now when you run the project, you will be directed to:
Since the registration page does not contain anything to register a user, we will design the Registration Page as in the following:
Code:
- <html xmlns="http://www.w3.org/1999/xhtml">
- <head id="Head1" runat="server">
- <title></title>
- </head>
- <body>
- <form id="form1" runat="server">
- <div>
- <table>
- <tr>
- <td>
- <asp:Label ID="lbl_UserName" runat="server" Text="User Name"></asp:Label>
- </td>
- <td>
- <asp:TextBox ID="tb_UserName" runat="server"></asp:TextBox>
- </td>
- </tr>
-
- <tr>
- <td>
- <asp:Label ID="lbl_Password" runat="server" Text="Password"></asp:Label>
- </td>
- <td>
- <asp:TextBox ID="tb_password" runat="server"></asp:TextBox>
- </td>
- </tr>
-
- <tr>
- <td>
- <asp:Label ID="lbl_Confpass" runat="server" Text="Confirm Password"></asp:Label>
- </td>
- <td>
- <asp:TextBox ID="tb_ConfPass" runat="server"></asp:TextBox>
- </td>
- </tr>
-
- <tr>
- <td>
- <asp:Label ID="lbl_Email" runat="server" Text="Email"></asp:Label>
- </td>
- <td>
- <asp:TextBox ID="tb_Email" runat="server"></asp:TextBox>
- </td>
- </tr>
-
- <tr>
- <td colspan="2">
- <asp:Label ID="lbl_Message" runat="server" ForeColor="Red"></asp:Label>
- </td>
- </tr>
-
- <tr>
- <td colspan="2">
- <asp:Button ID="btn_Register" runat="server" Text="Register"/>
- </td>
- </tr>
- </table>
- </div>
- </form>
- </body>
- </html>
-
Creating a Database in SQL Server
Open SQL Server and create a new database “mysamle” as in the following:
Create a new Table “tblUsers” in the mysamle database as in the following:
Check wheteher or not the table was created.
Create a Stored Procedure and name it “spRegisterUser”.
-
Making a connection between Project and SQL Database
Open the Web.conifig file, one that is not present in the registration folder.
Replace the code with the following code.
Code:
- <configuration>
- <connectionStrings>
- <add name="jsb_ConnectionString" connectionString="data source=.; database=mysamle; user id=sa; password=Password$2"/>
- </connectionStrings>
- <system.web>
- <compilation debug="true" targetFramework="4.0" />
- <authentication mode="Forms">
- <forms loginUrl="Login.aspx" defaultUrl="Welcome.aspx">
- <credentials passwordFormat="Clear">
- </credentials>
- </forms>
- </authentication>
- <authorization>
- <deny users="?"/>
- </authorization>
- </system.web>
- </configuration>
Now open the Register.aspx.cs page and add the following namespaces.
Code:
- using System.Configuration;
- using System.Data.SqlClient;
- using System.Data;
- using System.Web.Security;
In between of bttn_Register_Click add the following code.
Code:
- protected void btn_Register_Click(object sender, EventArgs e)
- {
- if (Page.IsValid)
- {
- string CS = ConfigurationManager.ConnectionStrings["jsb_ConnectionString"].ConnectionString;
- using (SqlConnection con = new SqlConnection(CS))
- {
- SqlCommand cmd = new SqlCommand("spRegisterUser", con);
- cmd.CommandType = CommandType.StoredProcedure;
-
- string EncriptedPassword = FormsAuthentication.HashPasswordForStoringInConfigFile(tb_password.Text, "SHA1");
-
- SqlParameter username = new SqlParameter("@UserName", tb_UserName.Text);
- SqlParameter password = new SqlParameter("@Password", EncriptedPassword);
- SqlParameter email = new SqlParameter("@Email", tb_Email.Text);
-
- cmd.Parameters.Add(username);
- cmd.Parameters.Add(password);
- cmd.Parameters.Add(email);
-
- con.Open();
-
- int ReturnCode = (int)cmd.ExecuteScalar();
- if (ReturnCode == -1)
- {
- lbl_Message.Text = "User Name already in use, please choose another user name";
- }
- else
- {
- Response.Redirect("~/Login.aspx");
- }
- }
- }
- }
Run the project and click on “Click here to register”.
Do a registration as in the following:
Now the user is registered and will be directed to the Login Page, where only a valid user can login.
The following shows the credentials of user “jsb” in the database.
Now, If we want to store an encrypted password in the database then we will do it as in the following. Open the Register.aspx page and edit the code to the following.
Code:
- string EncriptedPassword = FormsAuthentication.HashPasswordForStoringInConfigFile(tb_password.Text, "SHA1");
- SqlParameter username = new SqlParameter("@UserName", tb_UserName.Text);
- SqlParameter password = new SqlParameter("@Password", EncriptedPassword);
- SqlParameter email = new SqlParameter("@Email", tb_Email.Text);
Register again:
Check again the credentials of the user “encrypt” in the database.
I hope, you enjoyed.