Security in ASP - Net Part1

) (
.....

....
.

.

Asp.net ) (Security ). (Ajax
: Login Controls

)
( .
(Asp.net )Membership
) (Membership . :
: Login .
: Create User Wizard
.
: Login Status .
:Login Name .
:Change Password
.
:Password Recovery
.
:Login View
.

): (Test
): (Web.Config
>"<authentication mode ="Forms
:
) (Security ) (Protect.aspx
) (Web.Config ): (Login.aspx
Protect.aspx
Login.aspx
) (Web.Config ) (Security
> <authorization
><deny users ="?"/
></authorization
) (Protect.aspx .
)] (Authentication .i
[
Windows Authentication )
(
) (Intranet Active Directory
Form Authentication

. . Form Web.Config
.
) ] ( Authorization .ii
[ . Web.config
) (Security
. Security
Protect
.
:LoginControl
) (Render
) (
Asp.net )
(Membership .

) (Return URL
) (
.
) (Login
) (Default.aspx
) (Return URL
) (Login
) (Login
) (ReturnURL ) (Destination Page Url
) Destiantion
(Page URL
.
Login Visiable When LoginIn

Login
Login . Master Page
Login ) (Template
Layout
Template ID ) Text Box Label
( :
UserName
Password
RememberMe
FailureText
: ( Login ) Command Name Button
: Login.aspx
<%@ Page Language="C#" AutoEventWireup="true"

CodeFile="Login.aspx.cs" Inherits="Login" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0

Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-
transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
<style type ="text/css" >
.LoginError
{
color :Red ;
}
</style>
</head>
<body style="text-align: center">
<form id="form1" runat="server">
<div dir ="rtl" >
<asp:Login ID="Login1" runat="server">
<LayoutTemplate >
<asp:Label ID="FailureText" EnableViewState
="false" runat ="server" CssClass ="LoginError" />
<br />
<asp:Label ID="lblUserName" Text =" :"
AssociatedControlID ="UserName" runat ="server" />
<asp:TextBox ID="UserName" runat ="server" />
<br /><br />
<asp:Label ID="lblPassword" runat ="server" Text
=" " AssociatedControlID ="Password" />
<asp:TextBox ID="Password" runat ="server" />
<br /><br /><hr />
<asp:Button ID="btnSave" Text ="" runat
="server" CommandName ="Login" />
</LayoutTemplate>
</asp:Login>
</div>
></form
></body
></html
Login Asp.Net Memebership

) (Authenticate Login :
Web.Config ) (Test
:
> <forms
>"<credentials passwordFormat ="Clear
><user name ="Mohamed" password ="123456"/
></credentials
></forms
:
LoginTest.aspx
Login
) (Login1_Authenticate :
protected void Login1_Authenticate(object sender,
AuthenticateEventArgs e)
{
string Username = Login1.UserName;
string Password = Login1.Password;
e.Authenticated =
System.Web.Security.FormsAuthentication.Authenticate
(Username, Password);
( Authenticate Event)
True Authenticated
False
( FormsAuthentication.Authenticate)
. Web.config Login Control
:Create User Wizard
) (Render
) (Asp.net Membership .
) (Create User Wizard :
User Name
Password
Confirm Password
Email
Security Question
Security Answer
) (Test2
Asp.net (Solution ) Explorer ) (CreateUser.Aspx )
: (Configuration
)(Security
) (Users ) (Select Authentication Type .

(Done) . (Form the internet)
)
Solution ) ( Refresh) (Asp.Net Configurations
( App_Data) ( Explorer
: Web.Config ( ASPNETDB.MDF)
<configuration>
<system.web>
<authentication mode ="Forms"/>
<compilation debug="false" targetFramework="4.0" />
</system.web>
</configuration>
Authentication Asp.Net Configuration

. Web.Config Authentication
Create User Wizard CreateUser.aspx

.
( Security Question ,Security Answer)
. Web.config
<configuration>
<system.web>
<authentication mode="Forms" />
<membership defaultProvider ="MyMembership">
<providers >
<add name ="MyMembership"
type ="System.Web.Security.SqlMembershipProvider"
connectionStringName ="LocalSqlServer"
requiresQuestionAndAnswer="false"/>
</providers>
</membership>
<compilation debug="false" targetFramework="4.0" />
</system.web>
</configuration>
( Unique)
. Web.Config
requiresUniqueEmail="false"
(Required Email =False) ( E-mail)

CreateUserWizard
. False= (RequiresUniqueEmail)

. (Mail Definition )
( CreateUser2.Aspx) ( Register) ( TextFile)

:
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="CreateUser2.aspx.cs"

Inherits="CreateUser2" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<title></title>
</head>
<body>
<div>
<asp:CreateUserWizard ID="CreateUser1" runat ="server" >
<MailDefinition BodyFileName ="~/Register.txt" Subject ="UserName And
>password" From ="Your Email" /
></asp:CreateUserWizard
></div
></form
></body
></html
) (Register.txt
:

>: <% UserName %
>: <% Password %
( <%UserName )>%
.

: Web.Config
> <system.net
> <mailSettings
><smtp deliveryMethod ="PickupDirectoryFromIis"/
></mailSettings
></system.net
( Gmail )
:
<system.net >
<mailSettings >
<smtp >
<network host="smtp.gmail.com" password="********" port="587"
userName="Your Name" enableSsl ="true " defaultCredentials ="false "
/>
</smtp>
</mailSettings>
</system.net>
: Mail Definition
. : Body File Name

. : CC
: Embedded Object
.
. : From
Html : IsBody HTML
. : Priority
. : Subject
:
( Auto Generate Password =True)
. ( Login Create User =False)
<asp:CreateUserWizard ID="CreateUser1" runat ="server"
AutoGeneratePassword="True" LoginCreatedUser="False" >
<MailDefinition BodyFileName ="~/Register.txt" Subject ="UserName And
password" From ="Your Email" />
</asp:CreateUserWizard>
:
( Confirm.aspx)
( Code.html) ( CreateUser3.aspx)
.
: (CreateUser3.aspx)


<title></title>
</head>
<body>
<div>
<asp:CreateUserWizard ID="CreateUser"
CompleteSuccessText =""
DisableCreatedUser ="true" ContinueDestinationPageUrl
="~/Confirm.aspx"
runat ="server" onsendingmail="CreateUser_SendingMail" >
<MailDefinition BodyFileName ="~/Code.htm" IsBodyHtml ="true" Subject
="Confirmations" From ="Your Email" />
</div>
</form>
</body>
</html>
: CreateUser3.aspx Code Behind
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.Security;
public partial class CreateUser3 : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void CreateUser_SendingMail(object sender, MailMessageEventArgs
e)
{
MembershipUser User = Membership.GetUser(CreateUser.UserName);
string Code = User.ProviderUserKey.ToString();
e.Message.Body = e.Message.Body.Replace("<%ConfirmationCode %>", Code);
}
}
: (Code.Html)

<head>
<title></title>
</head>
<body>
<br/>
<%ConfirmationCode %>
</body>
</html>
: ( Confirm.aspx)
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Confirm.aspx.cs"

Inherits="Confirm" %>

<title></title>
</head>
<body>
<div dir ="rtl" >
<asp:Label ID="lblError" runat ="server" EnableViewState ="false" ForeColor
="Red" />
<br /><br />
<asp:Label ID="lblName" AssociatedControlID ="txtUserName" runat ="server"
Text =" :" />
<asp:TextBox ID="txtUserName" runat ="server" />
<br />
<asp:Label ID="lblConfirm" Text =" : " runat ="server"
AssociatedControlID ="txtConfirm" />
<asp:TextBox ID="txtConfirm" runat ="server" />
<br /><br />
<asp:Button ID="btnConfirm" runat ="server" Text ="Confirm"
onclick="btnConfirm_Click" />
</div>
</form>
</body>
</html>
: Code Behind
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.Security;
public partial class Confirm : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void btnConfirm_Click(object sender, EventArgs e)
{
MembershipUser User = Membership.GetUser(txtUserName.Text);
if (User == null)
{
lblError.Text = ";"
}
else
{
string ProviderCode = User.ProviderUserKey.ToString();
string UserCode = txtConfirm.Text.Trim();
if (ProviderCode != UserCode)
{
lblError.Text = ";"
}
else
{
User.IsApproved=true ;
Membership.UpdateUser(User);
lblError.Text = ";"
}
}
}
}
Create User Wizard

: ( Id)
UserName
Password
Email
ConfirmPassword
Question
Answer
ErrorMessage
:( CreateUser4 .aspx)


<title></title>
</head>
<body>
<div dir ="rtl" >
<asp:CreateUserWizard ID="CreateUser" runat ="server" >
<WizardSteps >
<asp:CreateUserWizardStep >
<ContentTemplate >
<h1>< /h1>
<asp:Label ID ="ErrorMessage" ForeColor ="Red" runat ="server" />
<br /><br />
<asp:Label ID="lblUserName" AssociatedControlID ="UserName" runat ="server"
Text =" :" />
<br />
<asp:Label ID="lblPassword" Text =" :" runat ="server"
AssociatedControlID ="Password" />
<asp:TextBox ID="Password" runat ="server" TextMode ="Password" />
<br />
<asp:Label ID="lblEmail" runat ="server" Text =" :" AssociatedControlID
="Email" />
<asp:TextBox ID="Email" runat ="server" />
<br />
<asp:Label ID="lblQuestion" Text =" :" runat ="server"
AssociatedControlID ="Question" />
<asp:DropDownList ID="Question" runat ="server" >
<asp:ListItem Text =" " Value =" " />
<asp:ListItem Text =" " Value =" "/>
</asp:DropDownList>
<br />
<asp:Label ID="lblAnswer" Text =" :" runat ="server"
AssociatedControlID ="Answer" />
<asp:TextBox ID="Answer" runat ="server" />
</ContentTemplate>
</asp:CreateUserWizardStep>
</WizardSteps>
</div>
</form>
</body>
</html>
: Login Status Control
. (Logout Login)
.(Test5.aspx) ( Login.aspx) Test2
: (Login) ( Login .aspx)
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Login.aspx.cs"

Inherits="Login" %>

<title></title>
</head>
<body>
<div>
<asp:LoginName ID="LoginName1" runat="server" />
</div>
</form>
</body>
</html>
Loginstatus : ( Test5.aspx)
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Test5.aspx.cs"

Inherits="Test5" %>

<title></title>
</head>
<body>
<div>
<asp:LoginStatus ID="LoginStatus1" runat="server" />
<hr />
<h1>< /h1>
></div
></form
></body
></html
: Test5.aspx
Login . Login.aspx
: Login Status
: Login Image Url . Login

: Login Text . Login
: Logout Action Logout
Refresh Redirect . Redirect to Login Page
: Logout Image Url . Logout
:LogoutPageUrl
) (Redirect
. Logout
: Logout Text . Logout
: Logging Out .
:Logged Out .
: Login Name Control

Forms Login.aspx )
(Authentication
Login.aspx :
) (Tassgiel.aspx
Web.config :
>"<authentication mode="Forms
><forms loginUrl ="Tassgiel.aspx"/
></authentication
:Change Password Control
ChangePassword.aspx Test2
ChangePassword
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="ChangePassword.aspx.cs"

Inherits="ChangePassword" %>

<title>< /title>
</head>
<body>
<div dir ="rtl" >
<asp:ChangePassword ID="ChangePassword1" runat="server"
CancelButtonText=" "ChangePasswordButtonText=""
ChangePasswordTitleText=""
ConfirmNewPasswordLabelText=""
NewPasswordLabelText=""
PasswordLabelText=" " DisplayUserName="True"
UserNameLabelText=" " BackColor="#FFFBD6"
BorderColor="#FFDFAD"
BorderPadding="4" BorderStyle="Solid" BorderWidth="1px" Font-
Names="Verdana"
Font-Size="0.8em" Height="201px">
<CancelButtonStyle BackColor="White" BorderColor="#CC9966"
BorderStyle="Solid"
BorderWidth="1px" Font-Names="Verdana" Font-Size="0.8em"
ForeColor="#990000" />
<ChangePasswordButtonStyle BackColor="White" BorderColor="#CC9966"
BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana"
Font-Size="0.8em"
<ContinueButtonStyle BackColor="White" BorderColor="#CC9966"
BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana"
Font-Size="0.8em"
<InstructionTextStyle Font-Italic="True" ForeColor="Black" />
<PasswordHintStyle Font-Italic="True" ForeColor="#888888" />
<TextBoxStyle Font-Size="0.8em" />
<TitleTextStyle BackColor="#990000" Font-Bold="True" Font-
Size="0.9em"
ForeColor="White" />
</asp:ChangePassword>
</div>
</form>
</body>
</html>
( Display UserName) ChangePassword

( True)
) (Administrator
.

) (False . ChangePassword

Text . Password.txt
<% UserName %>

<%Password %>
: (ChangePassword2.aspx)
<%@ Page Language="C#" AutoEventWireup="true"

CodeFile="ChangePassword2.aspx.cs" Inherits="ChangePassword2" %>

<title></title>
</head>
<body>
<div dir ="rtl" >
<asp:ChangePassword ID="ChPassword" runat ="server" DisplayUserName ="true"
>
<MailDefinition From ="YourEmail" BodyFileName ="~/Password.txt" Subject
=">"
</MailDefinition>
</asp:ChangePassword>
</div>
</form>
</body>
</html>
ChangePassword
: ID ( ChangePassword Template)
UserName
CurrentPassword
ConfirmPassword
NewPassword
FailureText
: Command Name Button
Change Password
Cancel
Continue
: Password Recovery Control
:
) (Reset
.
Password
Recovery
) (Web.Config ) (Membership
) ( Password Format Hash

) ( Encrypted ) (Clear )(Encrypted
)
( )wireshark
(.
) ( Enable Password Retrieval

False ). ( True
) (Enable Password Reset )( True

. False
>"<membership defaultProvider ="MyMembership

> <providers
<add name ="Mymembership" type ="SSystem.Web.Security.SqlMembersh
"ipProvider" connectionStringName="LocalSqlServer" passwordFormat="Clear
>enablePasswordRetrieval="True"/
></providers
></membership
Password Recovery
) (Security Question

). (Web.Config
<membership defaultProvider ="MyMembership">
<providers >
<add name ="Mymembership" type ="SSystem.Web.Security.SqlMembershipProvider
" connectionStringName="LocalSqlServer" passwordFormat="Clear"
enablePasswordRetrieval="True" requiresQuestionAndAnswer="false"/>
</providers>
</membership>
( Password Recovery)
:
.

.
. Password Recovery
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Default.aspx.cs" In

herits="_Default" %>
<!DOCTYPE html PUBLIC "-

//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xht
ml1-transitional.dtd">
<title></title>
</head>
<body>
<div dir ="rtl" >
<asp:PasswordRecovery ID="Pr1" runat ="server" >
<MailDefinition From ="YourEmail" Subject =" " BodyFileName ="~/P
asswordRecovery.htm" />
<UserNameTemplate >
<h1>< /h1>
<asp:Label ID="FailureText" EnableViewState ="false" runat ="server" Fo
reColor ="Red" />
<br />
<asp:Label ID="lblUserName" runat ="server" Text =" " />
<br />
<br />
<hr />
<asp:Button ID="btnSubmit" runat ="server" Text ="<<" CommandName ="Sub
mit" />
</UserNameTemplate>
<QuestionTemplate >
<h1>< /h1>
<asp:Label ID="FailureText" EnableViewState ="false" runat ="server" Fo
reColor ="Red" />
<br />
<asp:Label id="Question" Text=" " AssociatedControlID="Answer" Ru
nat="server" />
<br />
<asp:TextBox id="Answer" Runat="server" />
<br />
<asp:Button id="btnSubmit" Text=" "CommandName="Submit" Runat="server"
/>
</QuestionTemplate>
<SuccessTemplate >
<h1>< /h1>

</SuccessTemplate>
</asp:PasswordRecovery>
</div>
</form>
</body>
</html>
: PasswordRecovery.htm
<head>
<title></title>
</head>
<body>
<div dir ="rtl">

:
<br />
<%UserName %>
<br />

<%Password %>
</div>
</body>
</html>
: Login View Control
. (Roles)
: Anonymous Template
. : Logged In Template
. ( Role) : Role Groups
.( )
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Default2.aspx.cs" I

nherits="Default2" %>

<title></title>
</head>
<body>
<div dir ="rtl" >
<asp:LoginStatus ID="loginstatus1" runat ="server" />
<hr />
<hr />
<asp:LoginView ID="loginView1" runat ="server">
<AnonymousTemplate >

</AnonymousTemplate>
<LoggedInTemplate >

</LoggedInTemplate>
</asp:LoginView>
</div>
</form>
</body>
</html>

) ( Security Security
Asp.net .
...
http://mohamediddan.wordpress.com/

Security in ASP - Net Part1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security in ASP - Net Part1

Uploaded by

Copyright:

Available Formats

) (

>"<authentication mode ="Forms

Login Visiable When LoginIn

: ( Login ) Command Name Button

<%@ Page Language="C#" AutoEventWireup="true"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0

Login Asp.Net Memebership

) (Create User Wizard :

) (Users ) (Select Authentication Type .

Authentication Asp.Net Configuration

Create User Wizard CreateUser.aspx

(Required Email =False) ( E-mail)

( CreateUser2.Aspx) ( Register) ( TextFile)

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="CreateUser2.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

. : Body File Name

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="CreateUser3.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Confirm.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

Create User Wizard

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="CreateUser4.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

: (Login) ( Login .aspx)

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Login.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Test5.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

: Login Image Url . Login

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="ChangePassword.aspx.cs"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

( Display UserName) ChangePassword

<%@ Page Language="C#" AutoEventWireup="true"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

: Command Name Button

) ( Enable Password Retrieval

) (Enable Password Reset )( True

>"<membership defaultProvider ="MyMembership

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Default.aspx.cs" In

<!DOCTYPE html PUBLIC "-

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Default2.aspx.cs" I

<!DOCTYPE html PUBLIC "-

You might also like