Robust Forms Authentication: Is this the best way?

Question

I have implemented forms authentication in to my site, this works great. But, is it the correct and most secure way? Here is my code below whent he user logs into the system.

 FormsAuthentication.SetAuthCookie(User.ID.ToString(), true);

I have been using the Name stored in the Auth Cookie to populate the profile page and other sections that require the user id, such as logging:

 HttpContext.Current.User.Identity.Name

Is this the correct way to implement Forms auth? Or am I way off? If I am, which I believe is the case please provide constructive comments or a link that shows the correct way to implement forms authentication.

Thanks

Answer 1

Yep, that's correct.

You can improve the process by using ASP.NET Membership , which ties in with forms authentication to manage user profiles and roles. It does a lot of the leg work for you.

Answer 2

you can use FormsAuthenticationTicket to build a customized ticket.

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
    username,
    DateTime.Now,
    DateTime.Now.AddMinutes(30),
    isPersistent,
    userData,
    FormsAuthentication.FormsCookiePath);

  // Encrypt the ticket.
  string encTicket = FormsAuthentication.Encrypt(ticket);

for your information: http://msdn.microsoft.com/en-us/library/system.web.security.formsauthenticationticket.aspx

Answer 3

No, you are not way off. This is the right way to do it and you are using HttpContext.Current.User.Identity.Name correctly.