ASP.NET Security. 7/26/2017 EC512 Prof. Skinner 1

Size: px

Start display at page:

Download "ASP.NET Security. 7/26/2017 EC512 Prof. Skinner 1"

Reynard Henderson
6 years ago
Views:

1 ASP.NET Security 7/26/2017 EC512 Prof. Skinner 1

2 ASP.NET Security Architecture 7/26/2017 EC512 Prof. Skinner 2

3 Security Types IIS security Not ASP.NET specific Requires Windows accounts (NTFS file system) Protects all files ASP.NET forms based security Authentication does not require Windows accounts Protects only ASP.NET files ASP.NET Identity classes provide user management 7/26/2017 EC512 Prof. Skinner 3

4 IIS Security 7/26/2017 EC512 Prof. Skinner 4

5 IIS Security Types Basic (user/password in the clear) Digest (not used very often domain based) Windows (only works with Windows systems) Client Certificate Windows account credentials NTFS file permissions need to be set Anonymous access uses special account Demo 7/26/2017 EC512 Prof. Skinner 5

6 ASP.NET Forms Based Security 7/26/2017 EC512 Prof. Skinner 6

7 Forms Based 1. Create public pages in root folder 2. Create private pages in new folder 3. Create login page in root folder 4. Add code to authenticate 5. Add authentication section to web.config file in root folder 6. Add user credentials to web.config 7. Add "deny" tag to web.config in private folder 7/26/2017 EC512 Prof. Skinner 7

8 Public page 7/26/2017 EC512 Prof. Skinner 8

9 Page Language="C#" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="_Default" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" " <html xmlns=" <head runat="server"> <title>untitled Page</title> </head> <body> <h1 style="text-align: center"> This is a public page.</h1> <p style="text-align: center"> <br /> <a href="private">private Page</a><br /> <br /> </p> <form id="form1" runat="server"> <div> </div> </form> </body> </html> 7/26/2017 EC512 Prof. Skinner 9

10 Private Page 7/26/2017 EC512 Prof. Skinner 10

11 Page Language="C#" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="private_Default" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" " transitional.dtd"> <html xmlns=" <head runat="server"> <title>untitled Page</title> </head> <body> <form id="form1" runat="server"> <div> <h1 style="text-align: center"> This is a private page.</h1> <p style="text-align: left"> Welcome <asp:label ID="user" runat="server" Text="Label"></asp:Label> </p> </div> </form> <p> </p> </body> </html> 7/26/2017 EC512 Prof. Skinner 11

12 Code Behind using System; using System.Collections; using System.Configuration; using System.Data; using System.Linq; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.HtmlControls; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Xml.Linq; Add public partial class private_default : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { user.text = User.Identity.Name; } } 7/26/2017 EC512 Prof. Skinner 12

13 Login Page 7/26/2017 EC512 Prof. Skinner 13

14 using System; using System.Collections; using System.Configuration; using System.Data; using System.Linq; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.HtmlControls; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Xml.Linq; //Add following using System.Web.Security; public partial class login : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { } protected void Button1_Click(object sender, EventArgs e) { if (FormsAuthentication.Authenticate(user.Text, pass.text)) FormsAuthentication.RedirectFromLoginPage(user.Text, remember.checked); else Msg.Text = "Login failed. Please check your user name and password and try again."; } } 7/26/2017 EC512 Prof. Skinner 14

15 Code Behind <deleted lines> //Add following using System.Web.Security; public partial class login : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { } protected void Button1_Click(object sender, EventArgs e) { if (FormsAuthentication.Authenticate(user.Text, pass.text)) FormsAuthentication.RedirectFromLoginPage(user.Text, remember.checked); else Msg.Text = "Login failed. Please check your user name and password and try again."; Controls cookie } } 7/26/2017 EC512 Prof. Skinner 15

16 Authentication Section in web.config <authentication mode="forms"> <forms loginurl="login.aspx"> <credentials passwordformat="clear"> <user name="tom" password = "ec512" /> </credentials> </forms> </authentication> 7/26/2017 EC512 Prof. Skinner 16

17 Deny in web.config in private folder <authorization> <deny users="?" /> </authorization> 7/26/2017 EC512 Prof. Skinner 17

18 Login Make password field to hide text (TextMode property) 7/26/2017 EC512 Prof. Skinner 18

19 Cookie to save credentials 7/26/2017 EC512 Prof. Skinner 19

ASP.NET - MULTI THREADING

ASP.NET - MULTI THREADING http://www.tutorialspoint.com/asp.net/asp.net_multi_threading.htm Copyright tutorialspoint.com A thread is defined as the execution path of a program. Each thread defines a unique