seguridad en ASP.NET (C#)

En el Web.config.

<authentication mode="Forms">

   <forms name=".ASPXFORMSDEMO" loginUrl="logon.aspx"

   protection="All" path="/" timeout="30" />

</authentication>

 


<authorization>

   <deny users ="?" />

   <allow users = "*" />

</authorization>


private bool Validar_Usuario( string userName, string passWord )

{

SqlConnection conn;

SqlCommand cmd;

string lookupPassword = null;



// Check for invalid userName.

// userName must not be null and must be between 1 and 15 characters.

if ( (  null == userName ) || ( 0 == userName.Length ) || ( userName.Length > 15 ) )

{

System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of userName failed." );

return false;

}



// Check for invalid passWord.

// passWord must not be null and must be between 1 and 25 characters.

if ( (  null == passWord ) || ( 0 == passWord.Length ) || ( passWord.Length > 25 ) )

{

System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of passWord failed." );

return false;

}



try

{

// Consult with your SQL Server administrator for an appropriate connection

// string to use to connect to your local SQL Server.

conn = new SqlConnection( "server=localhost;Integrated Security=SSPI;database=pubs" );

conn.Open();



// Create SqlCommand to select pwd field from users table given supplied userName.

cmd = new SqlCommand( "Select pwd from users where uname=@userName", conn );

cmd.Parameters.Add( "@userName", SqlDbType.VarChar, 25 );

cmd.Parameters["@userName"].Value = userName;



// Execute command and fetch pwd field into lookupPassword string.

lookupPassword = (string) cmd.ExecuteScalar();



// Cleanup command and connection objects.

cmd.Dispose();

conn.Dispose();

}

catch ( Exception ex )

{

// Add error handling here for debugging.

// This error message should not be sent back to the caller.

System.Diagnostics.Trace.WriteLine( "[ValidateUser] Exception " + ex.Message );

}



// If no password found, return false.

if ( null == lookupPassword )

{

// You could write failed login attempts here to event log for additional security.

return false;

}



// Compare lookupPassword and input passWord, using a case-sensitive comparison.

return ( 0 == string.Compare( lookupPassword, passWord, false ) );



}





Generar el vale de autenticación
Cifrarlo
Crear una cookie
Agregarla a la respuesta y redirija al usuario.

Esto le ofrece más control sobre cómo crear la cookie. También puede incluir datos personalizados junto con FormsAuthenticationTicket en este caso.





private void cmdLogin_ServerClick(object sender, System.EventArgs e)

{

   if (Validar_Usuario(txtUserName.Value,txtUserPass.Value) )

   {

      FormsAuthenticationTicket tkt;

      string cookiestr;

      HttpCookie ck;

      tkt = new FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now,

DateTime.Now.AddMinutes(30), chkPersistCookie.Checked, "your custom data");

      cookiestr = FormsAuthentication.Encrypt(tkt);

      ck = new HttpCookie(FormsAuthentication.FormsCookieName, cookiestr);

      if (chkPersistCookie.Checked)

      ck.Expires=tkt.Expiration;

    ck.Path = FormsAuthentication.FormsCookiePath;

      Response.Cookies.Add(ck);



      string strRedirect;

      strRedirect = Request["ReturnUrl"];

      if (strRedirect==null)

            strRedirect = "default.aspx";

         Response.Redirect(strRedirect, true);

   }

   else

      Response.Redirect("logon.aspx", true);

}




Los Espacios de Nombres que debemos agregar:

using System.Data.SqlClient;
using System.Web.Security;