Membership(+ roles) VS session state VS form authentication

2
votes

I am considering Login and security mechanism at my testing site. Current situation is follows:

  • there is a table in database, with 3 columns (name, password, number to differentiate between access rights)
  • after successfull login and assigning access rights, session is created, with name of user and access rights
  • admin has access everywhere, user to certain pages and not logged user only to welcome and login page
  • every page is inherited from master page, where is some logic to check session
  • admin and user specific pages have control mechanism to determine access rights of current user in session

I also tried do this with membership and roles manager, however the database generated by asp.net is quite a big mess (big number of tables and records in every table). I have no idea how to configure membership and roles as I wrote above (mean simple table and use my own login controls).

But there are some advantages of membership and roles (easy to get number of logged users, less code, automatic logoff when closing page/browser, automatic session management, etc ...).

I was also thinking about forms authentication, but I am not sure, if there is such flexibility like with session and membership.

2
c#asp.netsessionforms-authenticationmembership

2 Answers

0
votes

Using Mebership and Role manager has many benefits. However sometimes the data generated by the default Membership and Role providers isn't sufficient enough.

For that purpose you can create custom membership, role providers and/or a custom membership user if you need your own data source or custom logic.

0
votes

Everything you want to do is already covered in the Membership provider which is very simple to use. If you do not need anything overly complex or custom I would seriously suggest looking again at the Membership provider as it would do exactly what you want to do, and it's tried and tested. Don't reinvent the wheel for the sake of it.

Take a look at these articles which cover the whole thing in good detail:

Examining ASP.NET's Membership, Roles, and Profile