如何使用VS 2010 / ASP.Net / VB.Net创建安全的登录页面？

Question

I would like to create a secure login page for a pre-defined set of users (so no creating username/passwords by the users themselves). I've looked up a few sites and they all seem to suggest using Microsoft's Membership or something. I am not very sure as to why that's used, but all you need to know is that I will be creating the login details. I just need to make the login secure, ie, no duplicate logins, no logins from different browsers and cookies and sessions and encryption and all that. Any one have the code/links to where I can get all this? Thanks in advance.

Answer 1

You have a couple of options here.

Case 1 : Role your own security but bear in mind you will oversee something. Security isn't easy and its sooo easy to overlook something. Hashing , salting , encryption etc...

Case 2: If its a simple site just use Microsoft memberschipprovider. It is good and they spend 3 years tweaking / patching it. You can also override the memberschipServiceprovider to implement some additional security. or to tell the memberschipprovider what data should be used.

Optional: Extend your ISS server with this open-source firewall : http://www.aqtronix.com/?PageID=99 It provides some cool features for "free"(If you have access to install it).

The best security is when you find the balance between secure and accessible vs Top-security and inaccessible.

And to answer the link part of your question: http://www.owasp.org/index.php/Main_Page

If you want more information on microsofts' memberschipprovider : Google :) or Bing or yahooooo!

Goodluck