Custom Login Authentication

[Wokawidget]

Unzip the code from the zip file, and create a VD in IIS called CustomAuthenticationDemo2003, which points at the dir you just unzipped.

This example uses cookies again, but this time we manually set them up. This gives you a little more contol as you can add time out limits.

All pages inherit my base page, which is:

Public Class MyBasePage
    Inherits System.Web.UI.Page
 
    Public Sub ValidateLogin()
        Dim Cookie As HttpCookie = Request.Cookies.Item("SECURITY")
        If Cookie Is Nothing Then
            Dim RedirectPage As String = Page.ToString.Substring(4).Replace("_", ".")
            Response.Redirect("Login.aspx?Redirect=" & RedirectPage)
        End If
    End Sub
 
    Public ReadOnly Property Username() As String
        Get
            Dim Cookie As HttpCookie = Request.Cookies.Item("SECURITY")
            If Not (Cookie Is Nothing) Then
                Return Cookie.Values.Item("USERNAME")
            End If
        End Get
    End Property

So in your web site your pages inherit MyBaseClass.
If in the Page Load event of a form if you want to secure it from unauthorised users just add:

MyBase.ValidateLogin()

As you can see from the above base page code that if the cookie doesn't exist then you get redirected to the login page. I have added a little bit of code in there for a redirect once you have logged in. This is very rough code and has some problems, ie it doesn't cater for querystrings, but it's only for an example anyways.

In the login.aspx page we have the login code:

Private Sub Login(ByVal Username As String, ByVal Password As String)
        If ValidateLogin(Username, Password) Then
            Dim Cookie As New HttpCookie("SECURITY")
            Cookie.Values.Add("USERNAME", Username)
            Response.Cookies.Add(Cookie)
            Dim RedirectPage As String = Request.QueryString.Item("Redirect")
            If RedirectPage = String.Empty Then
                RedirectPage = "Main.aspx"
            End If
            Response.Redirect(RedirectPage)
        End If
    End Sub

As you can see if the login is validated then a new cookie is created that stores the username. This is a session based cookie.

This where it's slightly better at Forms Auth as we can now add a timeout period onto the site.
So say if our user didn't access the site for say 20 minutes, we would want their session to timeout. This can be done by adding:

Cookie.Expires = Date.Now.AddMinutes(20)

just after you've decalred it.

One good thing about this method is that it can be easily changed. Maybe u don't want to use cookies. Maybe you want to use SQL server and store session GUIDs, which is what we do at work. Personally I prefer the cookie method. Bu the SQL sevrer way does have it's advantages.

Woka