EDUCBA

EDUCBA

MENUMENU
  • Free Tutorials
  • Free Courses
  • Certification Courses
  • 600+ Courses All in One Bundle
  • Login

ASP.NET MVC Authentication

By Priya PedamkarPriya Pedamkar

Home » Software Development » Software Development Tutorials » ASP.NET Tutorial » ASP.NET MVC Authentication

asp.net mvc authentication

Introduction to ASP.NET MVC Authentication

ASP.NET MVC Authentication is a feature in MVC that helps in making the website highly secure and safe. Authentication is the process of confirming or validating the user’s identity if the user who is trying to access the web page or web application is a genuine user or not. Every user has a user context defined in the active directory which has the principle property which in turn contains the Identity and the Roles attributes. The Identity attributes authenticate the user while the Role attributes authorize the permission to access the resources.  The IPrincipal and identity are implemented for using the Identity and the Role properties.

ASP.NET MVC Authentication

Authentication is one of the major features of the ASP.NET MVC as it is built upon the classic ASP.NET, it includes the validation properties provided with the ASP.NET making the web application robust, secure and safe. The Visual Studio provides an easy way to include the authentication at the first step of creating the web site.

Start Your Free Software Development Course

Web development, programming languages, Software testing & others

ASP.NET MVC Authentication - 1

On clicking on the Change Authentication button, another window pops up from where the type of authentication can be selected. The default mode is No Authentication. The web.config file of the project has an authentication tab as

<authentication mode=" "/>

The mode defines the mode of authentication and can be changed from the web.config file. The authentication mode can also be set from the properties window of the project.

What is MVC ASP.NET Authentication?

The ASP.NET MVC is a framework that combines the web development features of the ASP.NET with the Model View Controller architecture built upon the ASP.NET framework. In the model view controller design pattern, the concerns are separated from each other for example separating the data extraction login from the display logic. This leads to complexity in the design but provides more benefits. The Model View Controller design pattern fits perfectly with web applications.

ASP.NET MVC Authentication - 2

The ASP.NET MVC authentication can be done in four different ways

1. Individual Login Accounts

This is the usual Forms-based authentication, in which the user who visits the web site needs to create an account with his login name and password. These user credentials are stored in the SQL Server database. The passwords are of course hashed first and then stored in the database. The syntax for forms authentication would look like

Code:

[HttpPost] [ValidateAntiForgeryToken] public ActionResult Login(UserModel user)
{
if (ModelState.IsValid)
{
bool IsValidUser = _dbContext.Users
.Any(u => u.Username.ToLower() == user
.Username.ToLower() && user
.Password == user.Password);
if (IsValidUser)
{
FormsAuthentication.SetAuthCookie(user.Username, false);
return RedirectToAction("Index", "Employee");
}
}
ModelState.AddModelError("", "invalid Username or Password");
return View ();
}

2. Work or School Accounts

This type of authentication is mainly used for business workplaces where active directory services are used to store the data. These services usually provide a single sign-on facility for internal apps. It needs Office 365 or Azure Active Directory Services for this authentication.

Work or School Accounts

You can register your organization or multiple organization for the Work or Schools authentication giving it the domain name for ease of access.

3. Windows Authentication

This type of authentication is mostly used for intranet applications, where the website is launched from the desktop who is in the same domain or firewall. This helps the web site in retrieving the use of credentials from the Active Directory of the desktop. To enable windows authentication, the forms of authentication needs commenting from web.config file in the project.

Code:

<--
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>
-->
<authentication mode="Windows" />

4. No Authentication

Using No Authentication option means the web site and its pages are public and can be accessed by any person who visits the site. This can be used in case of public sites where the information displayed is not confidential and needs to be shown to all the users. The authentication can be changed later from the web.config file authentication tab.

Example

Step 1: Open visual studio in 2017. Create a new ASP.NET web application. A window asking what kind of web application you want to create will be displayed.

Create a new

  • Select MVC in the above window. Select the type of authentication you want for your web site by clicking on the Change Authentication button. Click on OK.

Step 2: Go to HomeController.cs and put an authorization on users accessing the web page.

Code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
namespace WebApplication3.Controllers
{
[Authorize] public class HomeController : Controller
{
public ActionResult Index()
{
return View();
}
[Authorize] public ActionResult About()
{
ViewBag.Message = "Your application description page.";
return View();
}
public ActionResult Contact()
{
ViewBag.Message = "Your contact page.";
return View();
}
}
}

  • The [Authorize] attribute can also be placed before the controller class which would lead to the need of authorizing all the methods in the controller.

Step 3: In RouteConfig.cs file check if the default Home Controller is HomeController. The default controller can be changed from this file and application can be made to point to custom controller created.

Code:

public static void RegisterRoutes(RouteCollection routes)
{
.
.
.
defaults: new {controller = "Default", action = "Index", id = UrlParameter.Optional }
);
}

Output:

On launching the site, it would ask for credentials as follows. Upon logging in the web page will be directed to.

ASP.NET MVC Authentication - 5

Conclusion

The ASP.NET MVC has very powerful authentication and authorization features making the web sites created in it secure and safe. The built-in features that come with Visual Studio help in creating a rich secure website in a very little time. The passwords are stored in the hashed form in the SQL server in case of Forms authentication which avoids the SQL injection issue. The forms authentication also allows smooth handling of account lock unlock issues. While with windows authentication, as the desktop and the web application sit in the same firewall, the cases of insecure logins are reduced considerably.

Recommended Articles

This is a guide to ASP.NET MVC Authentication. Here we discuss the introduction, what is ASP.NET MVC Authentication and its four different ways with detail explanation. You can also go through our other related articles to learn more –

  1. ASP.NET CheckBoxList
  2. ASP.NET SessionID
  3. ASP.NET Versions
  4. ASP.NET ValidationSummary

All in One Software Development Bundle (600+ Courses, 50+ projects)

600+ Online Courses

50+ projects

3000+ Hours

Verifiable Certificates

Lifetime Access

Learn More

0 Shares
Share
Tweet
Share
Primary Sidebar
ASP.NET Tutorial
  • ASP.NET Controls
    • ASP.NET Label
    • ASP.NET TextBox
    • Button in ASP.NET
    • ASP.NET CheckBoxList
    • ASP.NET DataList
    • RadioButton in ASP.NET
    • ASP.NET CheckBox
    • ASP.NET Hidden Field
    • ASP.NET LinkButton
    • ImageButton in ASP.NET
    • ASP.NET ListBox
    • Drop Down List in ASP.NET
    • ASP.NET Image
    • ASP.NET MVC ViewBag
    • ASP.NET GridView
    • Calendar in ASP.NET
    • ASP.NET Datagrid
    • ASP.NET Hyperlink
    • Timer in ASP.NET
    • ASP.NET Cookie
    • ASP.NET Session
    • ASP.NET SessionID
    • ASP.NET FileUpload
    • ASP.NET Download File
    • ASP.NET UpdatePanel
    • Authentication in ASP.NET
    • ASP.NET MVC Routing
    • ASP.NET MVC Authentication
    • ASP.NET ViewState
  • Basic
    • What is ASP.NET
    • Features of ASP.NET
    • ASP.NET Versions
    • ASP.NET Framework
    • What is MVVM
    • What is Eclipse IDE?
    • ASP.NET Page Life Cycle
    • ASP.NET Server Controls
    • Caching In ASP.NET
    • Data Binding in ASP.NET
    • What is ASP.Net Web Services
    • ASP.Net Interview Questions
    • Asp.Net MVC Interview Questions
    • AJAX Interview Questions
    • What is LINQ
    • Ajax in ASP.NET
  • ASP.Net Validation
    • ASP.Net Validation Controls
    • ASP.Net CompareValidator
    • ASP.NET RequiredFieldValidator
    • ASP.NET ValidationSummary
    • ASP.NET RegularExpressionValidator
Footer
About Us
  • Blog
  • Who is EDUCBA?
  • Sign Up
  • Corporate Training
  • Certificate from Top Institutions
  • Contact Us
  • Verifiable Certificate
  • Reviews
  • Terms and Conditions
  • Privacy Policy
  •  
Apps
  • iPhone & iPad
  • Android
Resources
  • Free Courses
  • Java Tutorials
  • Python Tutorials
  • All Tutorials
Certification Courses
  • All Courses
  • Software Development Course - All in One Bundle
  • Become a Python Developer
  • Java Course
  • Become a Selenium Automation Tester
  • Become an IoT Developer
  • ASP.NET Course
  • VB.NET Course
  • PHP Course

© 2020 - EDUCBA. ALL RIGHTS RESERVED. THE CERTIFICATION NAMES ARE THE TRADEMARKS OF THEIR RESPECTIVE OWNERS.

EDUCBA Login

Forgot Password?

EDUCBA
Free Software Development Course

Web development, programming languages, Software testing & others

*Please provide your correct email id. Login details for this Free course will be emailed to you
Book Your One Instructor : One Learner Free Class

Let’s Get Started

This website or its third-party tools use cookies, which are necessary to its functioning and required to achieve the purposes illustrated in the cookie policy. By closing this banner, scrolling this page, clicking a link or continuing to browse otherwise, you agree to our Privacy Policy

EDUCBA

*Please provide your correct email id. Login details for this Free course will be emailed to you
EDUCBA
Free Software Development Course

Web development, programming languages, Software testing & others

*Please provide your correct email id. Login details for this Free course will be emailed to you

Special Offer - All in One Software Development Bundle (600+ Courses, 50+ projects) Learn More