Question

Authenticating sessions with username/password works in desktop apps, where the session is kept open for the duration of the app.

But what about web apps? The expected use case is that the user logs in once with a username and password, and he is authenticated for the duration of his session. What do you recommend here? That we store his username/password in session state, and use it for Session.Authenticate on every request? Or would it be better that we store his User ID (Key) in a cookie, and be able to authenticate with the key (plus possibly a token)... e.g. Session.Authenticate(UserIdFromCookie [, TokenFromCookie]).

I don't like the idea of storing passwords in session state.

Answer 1

0

We use nearly this code in our web apps:

Getting Id of current user:

    public long AccountId {
        get {
            var httpContext = GetHttpContext();
            if (!httpContext.Request.IsAuthenticated)
                return 0;

            long id;
            if (!long.TryParse(httpContext.User.Identity.Name, out id))
                id = 0;
            return id;
        }
    }

And to store authentication info:

    FormsAuthentication.SetAuthCookie(account.Id.ToString(), rememberMe);

"Nearly", because actual code caches account info (DTO) in HttpContext.Items, etc.

answered Nov 20 '11 at 03:27

Alex Yakunin
2971●4●4●12

We already do this. What I was talking about is authenticating the session with a user... so that in future requests you can call session.GetImpersonationContext() from within an Entity and see which user "is logged in". I was under the impression that you must use session.Authenticate(username, password) in order to do so. Apparently, you can just use session.Impersonate(user). Is that correct?

(Nov 20 '11 at 04:12) ara

Answer 2

Ara,

These are 2 principally different operations: authentication & impersonation.

Session.Authenticate() should be used when you need to authenticate a user by his name & password or any other credentials. This method does nothing except checking credentials for validity and returning IPrincipal instance or null.

Session.Impersonate takes IPrincipal instance and configures current Session with the help of ImpersonationContext. So if you already know Key/ID/Token/Whatever of already authenticated user, you should use Session.Impersonate.

Hope that helps.

Subscription:

Related questions