Code On Time: Security

Blog

Security

Thursday, November 18, 2010Print Subscribe

Detecting Attempts to Access a Protected Page

Q. I built an application using web site factory. The application has a
dedicated login page. If I login as "admin" and navigate to the
membership page, then log out and log back in as "user" (which does
not have rights to the membership page), I get stuck. I think because
"user" does not have rights to visit the last page I visited before I
logged out, I can not get past the login page without logging back in
as admin, navigating off of membership page, then logging back out.

This is the standard ASP.NET behavior. You are signed in as a "user" but the redirect URL still tries to access the membership page, which "user" is not accessible to "user" account.

There are two options to fix that:

1) Offer a static link to the home page of your application in ~/App_Code/Controls/Login.acxs. User can click on the link to access the home page and break the login auto-redirects.

2) Add the following line of code into ~/App_Code/Controls/Login.ascx.cs:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

public partial class Controls_Welcome : System.Web.UI.UserControl
{
    
    protected void Page_Load(object sender, EventArgs e)
    {
        if (Page.User.Identity.IsAuthenticated && 
                !String.IsNullOrEmpty(Request.Params["ReturnUrl"]))
            Response.Redirect("~/Pages/Home.aspx");
    }
}

The code will detect the RedirectUrl parameter in the page URL and redirect the user to home automatically.

Labels: Security, Tips and Tricks

Friday, May 21, 2010Print Subscribe

Configuring Mail Settings

Q. Can you tell me in which component, file, etc is it that I configure the mail host that should be used to send out the password reminders.

You can configure mail settings of your application as follows:

Run Code OnTime Generator and select your project.
Click Next button a few times until your reach Web Server page in the project wizard.
Paste the text from the sample below into Web.Config modification instructions field. Make sure to use your own SMTP server settings as values.
Generate your project. The section system.net will be integrated into Web.Config file of your project whenever you generate the project next time.

InsertAfter: /configuration/connectionStrings
<system.net>
    <mailSettings>
      <smtp deliveryMethod="Network" from="ben@contoso.com">
        <network
          host="localhost"
          port="25"
          defaultCredentials="true"
        />
      </smtp>
    </mailSettings>
</system.net>

Note that InsertAfter instruction will insert the XML snippet just after the connectionStrings section in Web.Config configuration file of your application.

You can learn more about configuring mailSettings at http://msdn.microsoft.com/en-us/library/w355a94k.aspx.

Labels: Application Factory, Security, Tips and Tricks, Web.Config

Sunday, April 4, 2010Print Subscribe

Dedicated Login Page, Membership Customization Options

The latest release of Web Site Factory and Data Aquarium Framework support additional ASP.NET Membership configuration options. The menu of the available options is displayed in the screenshot below.

Here is a brief description of the available options.

Dedicated Login Page

The standard generated application features a fly-over login dialog that helps users to sign in. Users can also recover their password and sign up for new accounts as well. Sometimes you may want to have a dedicated login page with similar capabilities. If you enable a dedicated login page and generate your project then you will be greeted with the following login page when the application starts.

All application pages are automatically protected and any attempt to access a page will require a user to sign in. A dedicated user control ~/Controls/Login.ascx is automatically generated. You can freely change the control in Visual Studio according to your needs. The generator will not be trying to overwrite this control in the future. The default markup of the control is shown below:

<%@ Control Language="C#" AutoEventWireup="true" 
    CodeFile="Login.ascx.cs" Inherits="Controls_Login" %>
<%@ Register Src="Welcome.ascx" TagName="Welcome" TagPrefix="uc1" %>
<div class="SettingsPanel">
    <asp:Login ID="Login1" runat="server" TitleText="" Style="border-collapse: separate;"
        CreateUserText="Sign Up Now" 
        CreateUserUrl="javascript:Web.Membership._instance.signUp();"
        PasswordRecoveryText="Forgot Your Password?" 
        PasswordRecoveryUrl="javascript:Web.Membership._instance.passwordRecovery();">
    </asp:Login>
    <div style="width: 300px; margin: 20px -8px;">
        <uc1:Welcome ID="Welcome1" runat="server" />
    </div>
</div>

If you don’t want to allow password recovery or self-sign up then simply remove the corresponding properties from the control’s markup.

If a dedicated login page is enabled then the fly-over login dialog on the membership bar at the top of the pages will not be displayed anymore.

“Remember Me” Options

Two more new options control if the fly-over dialog will display “Remember me next time” check box in the fly-over login dialog. The “Remember Me” check box is unchecked by default. Now you can change that by requesting “Remember Me” option to be “checked”.

Password Recovery and Sign Up

Standard features of ASP.NET Membership are password recovery and self sign-up. You can now control if this options are available in your application. The following screenshot shows the fly-over dialog with “remember me”, “password recovery, and “sign up” features disabled. You can see the standard fly-over dialog in action with all features enabled at http://dev.codeontime.com/demo/WebSiteFactory3.

“My Account” and “Help”

Two more additional options allow to control if users can access and change their account and invoke the page-level help system. Here is the screen shot with both features enabled. You can see “My Account” and “Help” links on the membership bar.

Here the screen shot of the same page with both options disabled in the code generator project wizard.

Standalone Membership Database

You can also elect to create a standalone membership database. Read more about it at /blog/2010/03/standalone-aspnet-membership-database.html.

Future Enhancements

The upcoming updates to the premium projects will introduce support for Windows Authentication and also allow to create a custom authentication without dependencies on ASP.NET Membership while retaining all security features described in the tutorials at /blog/2009/12/security-pages-fields-actions.html. We will post a tutorial that will show how to use a database table to authenticate users on the dedicated login page.

The membership bar will also allow activating most recent used objects to allow quick navigation to the application objects that were recently accessed by users.

Labels: Application Factory, ASP.NET Membership, Release Notes, Security