Welcome to Day 15
Lab 25
In the previous lab we have implemented security for windows application
In this lab
we will implement security for
a web applications
There is a big difference in the way security is implemented in web applications
and the way the security is implemented in windows application
Windows application they are inside the computers
While web application run over the internet
Your web application is hosted on some server
Anybody who interact to that web app, it uses the HTTP protocol
it uses the Request Response model
For web application we can implement security by using windows authentication
forms authentication and passport authentication
You can go to the .NET and ASP.NET fundamentals section
where we have covered more details about the each one of these
authentication mechanism
We will be using form authentication
to implement security in our web app
Create a simple screen here called as the login screen
Create a simple page called as
login.aspx
In this login screen
create a two text boxes and one button
One text box will take the username
The other text box will take the password
We will have one submit button which will help us to validate
if this user is proper or not
Open the tool box and will create a simple screen which will take the username and password
Will have one very simple button here which will
push all these detail to the server for validation
I have dragged and droped one label and one text box for username
In the same way I will drag and drop one label and one text box for password
I will also need one button here
I am going to drag and drop one button which will help me to submit this username and password to the server
Let me put a proper text and naming convention to this label. I will name it as lblusername
This textbox will take the user name. I will make this TextBox name as txtUsername
In the same I will
name this label as
lblPassword
The name on the button will be
login
In order to enable forms authentication in our web application
we have to make couple of modification in our web config file
After you have gone through the fundamental videos of ASP.NET authentication and authorization
If you have not then this thing would be a bit difficult to digest
In case you have not gone still please go back see the video and then again restart this video
Let me tell what I will do here
We are going to define three things here
First we are going to enable forms authentication
Second we will need to give the start URL which will pop up the start page
Which will run when this application runs and that is
the login.aspx will be the start url
The pages which will be running or
the home page which will run after the authentication is done
Three things we have to define here. First
we will enable forms authentication
we will give the start page and third will give the page which will be seen once authentication is done
In order to enable forms authentication
Go ahead to the web config file. Type your authentication
Type mode=
When we type mode= there are lots of ways by which you can do authentication but we are going to select forms
That's the authentication mechanism we are going to use currently for this web application
Once we have defined the authentication by using forms authentication mechanism
What is going to be the start page which will run
when the application runs
Once the validation is done what is the home page which will run
Those two pages we need to define here
The start page which we would like to run login.aspx page
The home page which we would like to run after the validation is done
In order to define the
start page as well as
the subsequent pages
we are going to use the forms tag
In the forms tag we use the login url property to define the start page which will run. Our start page is login.aspx page
Once the user has validated his user id and password
CustomerDataEntry.aspx page should start running as a home page
By using the forms
tag there
I have defined the start page as login.aspx
Once the login.aspx page is successfully validated
We want the CustomerDataEntry.aspx page to run
By using the forms tag we have defined our start page and what our subsequent pages will be
When your application is on internet anybody can come to your website. If you have google.com, anybody can type google.com
Because you are trying to improve security in your application
You want to deny all those users who are anonymous
I have used the deny user tag and I have set by defining the question mark
Any kind of user who use anonymous
will not be allow to come to my site
We have done all the changes. Its time to
open our login.apsx page
Start writing some behind code
The first is
we have to import two namespaces
One namespace is our middle tier. In our middle tier we have a user component
which has a login logic which will help us to validate
if this user is proper or not
Because we are using forms authentication
we need to ensure we also import system.web.security namespace
so we can implement forms authentication
In the btn login click create a object of a user
To this user object we are going to pass two things
One we are going to pass username and the other thing which we are going to pass him is the password
For the username we have created one nice textbox called as txtUserName whatever is typed in txtUserName will set to
by obj.UsernameProperty
Whatever is typed in the txtpassword will be set to the objUser.Passwordproperty
Our user class had a IsValid function
which will return true if the entered user is proper
If objUser.IsValid is true
then please use the forms authentication class and redirect from the login page
to the home page. Home page currently is the CustomerDataEntry.aspx
To the redirect login page we need to pass him the username and also if you want to persist the cookie or not
If you are not understanding this statement Forms Authentication.RedirectFromLoginPage
Please go back to the fundamental videos of .NET and ASP.NET fundamentals and please see the complete authentication authorization videos what we have recorded
As soon as a person clicks on a login button
will create the object of the user
The object of the class user will pass him the username and password
Will check if it is valid
If it is valid then we can say now redirect from the login page
do the rest of the pages of the site
or stand where you are
We have done all our programming now build the solution
Exclude the warnings for now
He has gone ahead and ran my windows forms
Ensure we run our web application as startup
Once I have ran the application my web site is running
Because we defined our start page as login.aspx page
Deny any kind of user you are or anonymous
He has went ahead and executed my
login page first
Until you don't put the user id and password properly over here
I will not let you navigate the rest of the pages
Put the username and password here
Open the table where all our users stored
we have one user shiv and pass@123. If I type here shiv
Click on login. I have validated
There is one big problem here
The problem is this password
This pass@123 should not be visible like this on the screen
It should be masked in other words there should be some kind of a star(*) or a dot(.) rather than seeing the data directly
When anybody type something on the password, the password should not be visible on the computer , it should be either masked with the star(*) or a dot(.)
Go back to our visual studio
In order to make your textbox as a password textbox
Select your
textbox i.e password textbox
There is a value called as password here. You need to define the text mode as password
Select this as password
When I type something in the password it is now masked with Dots(.)
Anybody who is sitting behind your screen
does not see the password
By using the text mode we can make our text or normal textbox as a password enable textbox
He is allowing me to enter the screen
or enter the site
In this video we saw how we can enable forms authentication
on our web application. It was a three step process
First we went ahead and created a simple login screen
Then we went into the web config file and enabled forms authentication by using
a mode=forms
We also defined our start page as well as our subsequent pages
We said deny all the users for anonymous
In the login click, in the behind code click
we ensured that we check the user from the database
We call the forms redirectly login page
function
By using this four or five steps we were easily
able to enable
FormsAuthentication on our web application
Hope that you enjoyed this video in this video we were trying to understand
How we can enable forms authentication on web applications
Thank you so much
Whatever video you have seen
just a glimpse of what we have done
In case you are interested in our video package
Go to www.questpond.com
call on this number
You can ask the
complete dvd package what we have
In this DVD package we have covered
everything what a .NET developer wants
Right from basics of ASP.NET, Object Oriented Programming, SQL Server to new technologies like
WCF, Silverlight, LINQ, AZURE, Entity Framework
We also have UML, Architecture, Estimation, Project Management
There is a complete invoicing project end to end which is covered
You can get the better feel of how to create projects in a systematic manner
We have covered server products, both for sharepoint 2007 as well as for 2010
We have lot of best practices video on SQL Server etc
This complete package you can get from www.questpond.com
You can ask for the rates, its a very decent rated we have
In the same
as compare to the videos we also have one more product with us
i.e our interview question books
We have different kinds of interview question books right from .NET interview questions to SQL server interview questions
Sharepoint interview questions, Biztalk interview questions etc
If you are interested in the books part you can call on these numbers as per your location
These numbers on the board at this moment
Keep enjoying the videos, keep
seeing our
site and I hope you gain more knowledge
Thank you very much