my name is Prince. I'm a web developer in Asp.net(new) and I'm trying to create a function in which users can login into my site and I'll keep them logged in as long as they don't log out.
I thought of inserting their username and password into cookies, but I was informed that cookies are insecure. So I'm looking for a way to store their user Id and password. So when my page loads my code will go to where the user id and password are stored and log them in if its authenticated or exists in the database, else it'll direct them to the login page so they can log in. P.s on click of my login button it selects the values from the user id and password text boxes and inputs them the cookies or variables. Please if you need my to clarify myself or explain further I will gladly.
The summary of this is I want to create auto login and I need secure variables to store my user details e.g cookies, so the browser can access them(the cookies) the next time they(the user) come to my site and automatically log them in.
Related
I am faced with a beautiful enigma. In wordpress I have a widget that allows you to login with social login (google and facebook). When you login for the first time, the system automatically generates a password and username. This works well. I checked the database and password is correctly present as hashed.
Now, the problem is that if the user goes into profile settings and wants to change their password they have to enter current password first, but they can't know it since it was generated automatically.
I would like to give the user full control over the security of his account, so that he can change his password even if he is logged in with the social login.
So I foresee three possible solutions
Allow the password to be changed without entering the current one (but it seems insecure).
Email the automatically generated password (and I have no idea how I could do it). Or alternatively view it in the user's profile but I don't know how safe it is.
Disable social login and rely on the classic registration :)
Has anyone faced a similar situation before? Can you clarify this with some standard method / practice ?
You can allow the user to ask for a new password he/she specifies. The user will specify the password twice (password and confirm password fields) and then you:
encrypt the password the user asked for
store the encrypted value somewhere as password candidate (metadata, perhaps)
send an email to the user so he/she can confirm that he/she indeed asked for a password
once the user clicks on the link you have sent to him/her, replace the value of the password with the password candidate and remove the password candidate
Don't forget that the user is already logged in when he/she changes his/her password, adding an email validation to the password he/she asked for is pretty safe.
I'm setting up Forms Authentication for the first time.
I am validating the username and password(hashed) against a local SQL database.
All of this is working fine in my logon.aspx file in a ValidateUser() function.
I am also allowing the logon criteria to be persistent so the user does not have to re-enter their credentials when they return to the page.
The problem is, when the previously logged in user returns to my site and the cookie/ticket is used my ValidateUser() function is not called, SO... if I have deactivated the user or changed the user's password the user still gets logged in.
I've considered doing this in Application_AuthorizeRequest or Application_PostAuthorizeRequest in Global.asax, but I would also like to set some session variables at the time I re-verify the credentials against the database and the session is not yet created when these are called for the first time when a user logs in.
Any advise would be greatly appreciated.
For first time when user authorized at that time create session for that user e.g Session["Username"] check session whenever he enters in any page if session is not present redirect him to login page, after that when he log out abandon that session.
So whenever he want to access next time he wants to login again.
I am creating an asp.net web application with "Remember Me" option during Login and it has an Edit Profile module where users can change their passwords. Here is the scenario.
I logged into the website from Machine A clicking "Remember Me". So I am logged in and since a persistent cookie is created I dont need to login the next time
until my forms authentication times out.
I logged into the website from Machine B using the same account details I used above and from this machine, I changed my password. In this case How can I make the user in Machine A to login again? (Since my credentials have changed). The same scenario can happen if someone gets any user's credential and uses the application.
Thanks
You have to save the last credentials modification date in your database.
When a user try to consult a page of your website, you have to check the date specified in the cookie.
You can also make an AJAX system that verify each minute if any changes are done and, in that case, verify the validity of the credentials.
If the latest date is the "last credentials modification", then delete the cookie and ask the user to log by himself.
I have a ASP.NET website where multiple users access the site using same user credentials. The site functions fine when used by single user, however when a second user with the same credentials logs in simultaneously and the first user performs any action (clicks any link, selects any dropdown etc.), the first user is redirected to the default/login page. I want both the users to access the site without any trouble.
Can any one comment on why this is happening and how this can be solved.
My guess for the reason of the behaviour would be the authentication method you are using. Probably when the first user logs in he gets a session ID that authorises him for the following requests.
When another user uses the same credentials to log in, different session ID is created for that user so the ID the first user has is not valid any more, and therefore he gets redirected to the login page.
When the user checks on "Log me automatically" in the login page, I have a problem that the user is logged-in on my asp.net application but the login info has not been read from database.
In the normal case (manual login) when the user attemps to login, if the login operation has been succeeded then the user info (id, privileges) is read and is saved in a session variable.
The question is: How to save the userID with the session cookie and how to login in the database when auto login.
Thanks in advance.
I suspect you're using the login control but implementing your own code to authenticate the user. To make life really easy, have a look at How To: Use Membership in ASP.NET 2.0 which will automate the "log me in automatically" feature (and many more).
If you're doing this another way, it would help to provide some sample code.