Implementing “Remember Me” Feature in ASP.NET MVC

by

First off, you should never store the user’s credentials in a cookie. It’s incredibly insecure. The password will be passed with every request as well as being stored in plain text on the user’s machine.

Second, don’t reinvent the wheel, especially when security is concerned, you’ll never get it right.

ASP.Net already provides this functionality securely with Forms Authenitcation and Membership Providers. You should take a look into that. Creating a default MVC project will include the basic authentication setup. The official MVC site has more.

Update

You can still use .NET forms authentication without implementing a membership provider. At a basic level it would work like this.

You enable forms authentication in you web.config

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

You decorate the actions or the controllers you would like to secure with the [Authorize] attribute.

[Authorize]
public ViewResult Index() {
  //you action logic here
}

Then create a basic login action

[HttpPost]
public ActionResult Login(LoginViewModel dto) {

  //you authorisation logic here
  if (userAutherised) {
    //create the authentication ticket
    var authTicket = new FormsAuthenticationTicket(
      1,
      userId,  //user id
      DateTime.Now,
      DateTime.Now.AddMinutes(20),  // expiry
      rememberMe,  //true to remember
      "", //roles 
      "https://stackoverflow.com/"
    );

    //encrypt the ticket and add it to a cookie
    HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName,   FormsAuthentication.Encrypt(authTicket));
    Response.Cookies.Add(cookie);

    return RedirectToAction("Index");

  }

}

More Related Contents:

  1. What is routes.IgnoreRoute(“{resource}.axd/{*pathInfo}”)
  2. Route with Two optional parameters in MVC3 not working
  3. How to reuse Areas, Controllers, Views, Models, Routes in multiple apps or websites
  4. How do I specify different Layouts in the ASP.NET MVC 3 razor ViewStart file?
  5. How do you request static .html files under the ~/Views folder in ASP.NET MVC?
  6. ASP.NET MVC 3 – Partial vs Display Template vs Editor Template
  7. How do you share scripts among multiple projects in one solution?
  8. MVC 3 Model Binding a Sub Type (Abstract Class or Interface)
  9. ApiController returns 404 when ID contains period
  10. HTML.ActionLink vs Url.Action in ASP.NET Razor
  11. Using System.ComponentModel.DataAnnotations with Entity Framework 4.0
  12. Differences between Html.TextboxFor and Html.EditorFor in MVC and Razor
  13. How to change ‘data-val-number’ message validation in MVC while it is generated by @Html helper
  14. ASP.NET MVC3 and Windows Auth on IIS keeps redirecting to /Account/Login
  15. pass enum to html.radiobuttonfor MVC3
  16. Best place to set CurrentCulture for multilingual ASP.NET MVC web applications
  17. ASP.NET MVC – Authenticate users against Active Directory, but require username and password to be inputted
  18. asp.net mvc complex routing for tree path
  19. asp.net mvc keep object alive, information
  20. MVC 3 file upload and model binding
  21. ASP.net MVC – Display Template for a collection
  22. active menu item – asp.net mvc3 master page
  23. In what order are filters executed in asp.net mvc
  24. How to get current controller and action from inside Child action?
  25. Attribute Routing not working in areas
  26. Html.DisplayFor not posting values to controller in ASP.NET MVC 3
  27. Routing in Asp.net Mvc 4 and Web Api
  28. How do I create my own Scaffold Template in ASP.NET MVC 3?
  29. MVC 2 AreaRegistration Routes Order
  30. How can I create a route constraint of type System.Guid?

Leave a Comment