Click here to Skip to main content
15,888,610 members
Home / Discussions / Design and Architecture
   

Design and Architecture

 
QuestionAuto Complete Extender Pin
wantToLearn1-Jun-08 13:56
wantToLearn1-Jun-08 13:56 
AnswerRe: Auto Complete Extender Pin
Pete O'Hanlon1-Jun-08 21:56
mvePete O'Hanlon1-Jun-08 21:56 
QuestionManaging of Tab order in a Smart client application Pin
bluemoon200829-May-08 20:10
bluemoon200829-May-08 20:10 
AnswerRe: Managing of Tab order in a Smart client application Pin
led mike30-May-08 4:24
led mike30-May-08 4:24 
Questionbusiness use case Pin
mehrdadc4827-May-08 8:03
mehrdadc4827-May-08 8:03 
AnswerRe: business use case Pin
led mike27-May-08 8:30
led mike27-May-08 8:30 
GeneralRe: business use case Pin
Member 276708410-Jun-08 3:51
Member 276708410-Jun-08 3:51 
QuestionASP.NET Authentication and Scalability [modified] Pin
Waleed Eissa21-May-08 21:46
Waleed Eissa21-May-08 21:46 
Hi Gurus,

I'm trying to create a website with scalability in mind but I'm a little stuck with ASP.NET authentication (Forms Authentication) because I simply don't know much about its internals. I wonder how high traffic websites like myspace.com handle authentication. Most pages in my application are public (i.e. accessible to anyone authenticated or not), only a few pages are only available to authenticated users. I'm basically trying to find answers to those questions:

- As far as I understand from the documentation, ASP.NET Forms Authentication authenticates every request, ie. checks for the authentication cookie and if found it extracts the authentication ticket and decrypts it, is my understanding correct? And if so, can't this potentially affect performance esp. the decryption part? Is this needed for renewing the authentication cookies? (as I believe the ticket issuance time is saved inside the ticket so probably the cookie has to be decrypted anyway to get the ticket issuance time from the ticket then compare this to the current time and decide whether the cookie has to be renewed). If this is an absolute necessity (I'm talking about authenticating every request for the sake of cookie renewal), can we use an encryption algorithm with low overhead (in web.config, authentication element), still efficient? which encryption algorithm would you recommend in this case?

- Is there any way I could make ASP.NET only authenticate requests to protected pages (=pages that are only accessible to authenticated users), BTW, in my application I don't use roles I only make those pages accessible to any authenticated user. Actually I read somewhere that I could write the code needed to authenticate the user only in those protected pages but I wonder whether I will have to handle cookie renewal in this case (this is one thing that's automatically handled by ASP.NET forms authentication)

- Any ideas how I can get the last login with a persistent cookie? In my application I want to allow users to use the "remember me" option (which will send a persistent cookie to the user's computer), now the user doesn't log on explicitly anymore, so I can't put my code that saves the last login to the database in the login page hence it's not used by the user anymore, so how can I do this? I'm thinking about one way to do it but I'm a little worried about how this could impact performance, anyway, here's how .. in my application I need some user related data so I could probably get the data from the database whenever a user with a persistent cookie visits the site (probably FormsAuthentication_Authenticate is the most suitable place) and also write the last login to the database then cache the user data in ASP.NET's cache using the user login retrieved from the authentication cookie as the key with a sliding expiration (let's say something like 30 min or make it equal to the authentication session), if the user visits another page within this period (ie. before the data is removed from the cache), I get the data from the cache and all is ok, but if I can't find the data in the cache (ie, returns null) then I update the last login in the database and get the user data again from the database and cache it in ASP.NET's cache. What do you think about this solution? Do you have any better ideas? I know I could use sessions but I read somewhere that if you handle the session_start event the session is created anyway even if you don't have and data in the session which is not really a good idea (this mean that a session object will be created for all site users authenticated or not).

- what about security? Assume my encryption was broken by some hacker, can't the hacker insert a different user login in a ticket and encrypt it with my broken encryption key? In my application I'm using the user email address as the user login, so, probably a hacker can insert a random email address (from an email list for example) in the ticket and try to access the account of that user, if the user happens to have an account on the site, this will work. My question is that, is the cookie encryption the only way for protection? Because I believe it still can be broken no matter how good it is and in this case it can be a disaster as described above. I'm thinking about something to prevent this, I might probably add something like a random code in the users table in my database (let's call it a security code) and include that code along with the user login in the authentication ticket (separate it from the user login by some character like a pipe for example or put it in the userdata section in the authentication ticket) and whenever we get the data of this user from the users table, we check for the security code along with the user login, for example:

select userid, {other fields here} from users where userlogin = {user email retrieved from the authentication ticket} and SecurityCode = {security code retrieved from the authentication ticket}

Do you think this can be reliable?

Beside the questions above, if you have any resources on the internals of ASP.NET forms authentication, I'd be very grateful if you shared them with me. I've been searching the net for a couple of days but all I can find so far is only about how to use ASP.NET forms authentication in your applications e.g. how to configure it in web.config .. etc but nothing about its internals. I also tried to use .NET Reflector (specifically to disassemble FormsAuthenticationModule) and gained some understanding about how it works internally but not enough to figure it all out.

Sorry for my really long post!

Your help is really much appreciated ...


modified on Thursday, May 22, 2008 7:08 PM

Questionclass XXX and class XXXImpl Pin
Ahmed Charfeddine20-May-08 23:52
Ahmed Charfeddine20-May-08 23:52 
AnswerRe: class XXX and class XXXImpl Pin
Pete O'Hanlon21-May-08 22:07
mvePete O'Hanlon21-May-08 22:07 
GeneralRe: class XXX and class XXXImpl Pin
Scott Dorman25-May-08 2:42
professionalScott Dorman25-May-08 2:42 
GeneralRe: class XXX and class XXXImpl Pin
Stephen Hewitt26-May-08 15:15
Stephen Hewitt26-May-08 15:15 
GeneralRe: class XXX and class XXXImpl Pin
Ahmed Charfeddine26-May-08 23:22
Ahmed Charfeddine26-May-08 23:22 
GeneralRe: class XXX and class XXXImpl Pin
Pete O'Hanlon27-May-08 9:22
mvePete O'Hanlon27-May-08 9:22 
GeneralRe: class XXX and class XXXImpl Pin
led mike27-May-08 9:47
led mike27-May-08 9:47 
GeneralRe: class XXX and class XXXImpl Pin
Pete O'Hanlon27-May-08 10:01
mvePete O'Hanlon27-May-08 10:01 
GeneralRe: class XXX and class XXXImpl Pin
led mike27-May-08 10:19
led mike27-May-08 10:19 
GeneralRe: class XXX and class XXXImpl Pin
Mark Churchill9-Jun-08 18:21
Mark Churchill9-Jun-08 18:21 
AnswerRe: class XXX and class XXXImpl PinPopular
Shog925-May-08 11:54
sitebuilderShog925-May-08 11:54 
GeneralRe: class XXX and class XXXImpl Pin
Scott Dorman25-May-08 12:36
professionalScott Dorman25-May-08 12:36 
GeneralRe: class XXX and class XXXImpl Pin
Shog925-May-08 12:47
sitebuilderShog925-May-08 12:47 
GeneralRe: class XXX and class XXXImpl Pin
Scott Dorman25-May-08 14:12
professionalScott Dorman25-May-08 14:12 
GeneralRe: class XXX and class XXXImpl Pin
Ahmed Charfeddine26-May-08 23:23
Ahmed Charfeddine26-May-08 23:23 
GeneralRe: class XXX and class XXXImpl Pin
Mark Churchill9-Jun-08 18:20
Mark Churchill9-Jun-08 18:20 
QuestionAdvice on Architecture for customized application Pin
ruben ruvalcaba20-May-08 4:20
ruben ruvalcaba20-May-08 4:20 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.