Security Basics and ASP.NET Support Shane Johnson CS526 – S2008 University of Colorado at Colorado Springs Dr. Edward Chow

ASP.NET is a web application framework developed by Microsoft One of the centerpieces of the Microsoft .NET Framework The successor to Microsoft Active Server Pages (ASP) Can author applications in any .NET compatible language, including Visual Basic .NET, C#, and JScript .NET. Used by sites like: www.monster.com www.dell.com www.myspace.com www.match.com www.newegg.com Motivation: Explorer my interests in dynamic web-based content, and get familiar with ASP.NET as a potential server-side solution Overview

Security Operations in ASP.NET Authentication Authorization User Accounts Roles Security Operations in ASP.NET: Authentication : is the process of ascertaining the client’s identity. A client who has been successfully identified is said to be authenticated. An unidentified client is said to be unauthenticated or anonymous. Authorization : is the process of determining whether a particular user has the authority to access a specific resource or functionality. User Account: is a store for persisting information about a particular user. Role: is simply a label that is applied to a user and provides an abstraction for defining authorization rules and page-level functionality. Security Operations in ASP.NET

Forms-Based Authentication Common method of verifying the users identity is by prompting them to enter their credentials through a web form When a user attempts to access an unauthorized resource, they are automatically redirected to the login page where they can enter their credentials. The submitted credentials are then validated against a custom user store – (usually a database) Forms-Based Authentication

Figure 1: The Forms Authentication Workflow Unidentified User Requests Protected Page from server Server redirects unidentified user to login page The submitted credentials are then validated against a custom user store - usually a database A forms authentication ticket is created for the user (stored in a cookie) User is granted access to Protected Page Subsequent visits to the website include the forms authentication ticket in the HTTP request

Example Work First I created a sample web site Web.config file First I created a sample web site After creating a sample site, I added a Web.config file and changed the authentication configuration from the default “Windows” to “Forms”. <configuration> <system.web> <!– The <authentication> section enables configuration of the security authentication mode used by ASP.NET to identify an incoming user. --> <authentication mode="Forms" /> </system.web> </configuration> Example Work

Example Work cont. Login Page <%@ Page Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" CodeFile="Login.aspx.cs" Inherits="Login" %> <asp:Content ID="Content1" ContentPlaceHolderID="MainContent" runat="Server"> <h1> Login</h1> <p> Username: <asp:TextBox ID="UserName" runat="server"></asp:TextBox></p> Password: <asp:TextBox ID="Password" runat="server" TextMode="Password"></asp:TextBox></p> <asp:CheckBox ID="RememberMe" runat="server" Text="Remember Me" /> </p> <asp:Button ID="LoginButton" runat="server" Text="Login" OnClick="LoginButton_Click" /> <asp:Label ID="InvalidCredentialsMessage" runat="server" ForeColor="Red" Text="Your username or password is invalid. Please try again." Visible="False"></asp:Label> </asp:Content> Example Work cont.

Example Work cont. Event Handler for the login button protected void LoginButton_Click(object sender, EventArgs e) { // Three valid username/password pairs: Scott/password, Jisun/password, and Sam/password. string[] users = { "Scott", "Jisun", "Sam" }; string[] passwords = { "password", "password", "password" }; for (int i = 0; i < users.Length; i++) bool validUsername = (string.Compare(UserName.Text, users[i], true) == 0); bool validPassword = (string.Compare(Password.Text, passwords[i], false) == 0); if (validUsername && validPassword) FormsAuthentication.RedirectFromLoginPage(UserName.Text, RememberMe.Checked); } // If we reach here, the user's credentials were invalid InvalidCredentialsMessage.Visible = true; Assuming that the supplied credentials are valid, we need to create a forms authentication ticket, thereby logging in the user to the site. The FormsAuthentication class in the System.Web.Security namespace provides assorted methods for logging in and logging out users via the forms authentication system. While there are several methods in the FormsAuthentication class, the three we are interested in at this juncture are: GetAuthCookie(username, persistCookie) – creates a forms authentication ticket for the supplied name username. Next, this method creates and returns an HttpCookie object that holds the contents of the authentication ticket. If persistCookie is true, a persistent cookie is created. SetAuthCookie(username, persistCookie) – calls the GetAuthCookie(username, persistCookie) method to generate the forms authentication cookie. This method then adds the cookie returned by GetAuthCookie to the Cookies collection (assuming cookies-based forms authentication is being used; otherwise, this method calls an internal class that handles the cookieless ticket logic). RedirectFromLoginPage(username, persistCookie) – this method calls SetAuthCookie(username, persistCookie), and then redirects the user to the appropriate page. Example Work cont.

Detecting Authenticated Visitors and Determining Their Identity protected void Page_Load(object sender, EventArgs e) { if (Request.IsAuthenticated) WelcomeBackMessage.Text = "Welcome back!"; AuthenticatedMessagePanel.Visible = true; AnonymousMessagePanel.Visible = false; } else AuthenticatedMessagePanel.Visible = false; AnonymousMessagePanel.Visible = true; We can determine the name of the current visitor using the following code: string currentUsersName = User.Identity.Name; Assuming that the supplied credentials are valid, we need to create a forms authentication ticket, thereby logging in the user to the site. The FormsAuthentication class in the System.Web.Security namespace provides assorted methods for logging in and logging out users via the forms authentication system. While there are several methods in the FormsAuthentication class, the three we are interested in at this juncture are: GetAuthCookie(username, persistCookie) – creates a forms authentication ticket for the supplied name username. Next, this method creates and returns an HttpCookie object that holds the contents of the authentication ticket. If persistCookie is true, a persistent cookie is created. SetAuthCookie(username, persistCookie) – calls the GetAuthCookie(username, persistCookie) method to generate the forms authentication cookie. This method then adds the cookie returned by GetAuthCookie to the Cookies collection (assuming cookies-based forms authentication is being used; otherwise, this method calls an internal class that handles the cookieless ticket logic). RedirectFromLoginPage(username, persistCookie) – this method calls SetAuthCookie(username, persistCookie), and then redirects the user to the appropriate page. Example Work cont.

Success! Authentication Ticket Verified Example Work cont.

Future Work Experiment with Role-Based Authorization Create a custom interface to mange users accounts. Future Work

You can find a comprehensive tutorial on Security and ASP.NET at: http://www.asp.net/learn/security/?lang=cs Want to learn more?

References http://support.microsoft.com/kb/305140 http://msdn.microsoft.com/en- us/library/4w3ex9c2(vs.71).aspx http://www.asp.net/get-started/ http://www.asp101.com/articles/cynthia/ authentication/default.asp http://authors.aspalliance.com/aspxtreme /webapps/aspnetwebapplicationsecurity.a spx References