Re: AuthenticateRequest in Global.asax and a custom HTTP Module

From: Dominick Baier [DevelopMentor] (dbaier_at_pleasepleasenospamdevelop.com)
Date: 05/26/05 

Date: Thu, 26 May 2005 00:13:05 -0700

Hello Leslie,

the difference of global.asax and a httpModule is packaging. the module is
a dll (which can be potentially shared or GACed) - global.asax is always
local to that one app.

But if you are using WebServices - you should consider using WSE with UsernameTokens
- i don't think you should roll your own authentication scheme!

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> Thanks for helpine me here. If I understand you correctly, I think
> you are talking about form authentication. However, since I am
> writing a web service application, I can't use this approach. That is
> why I am thinking to use AuthenticateRequest from either the
> Blobal.asax or a custom HTTP module. But I am not sure about the
> difference of these two. Do you know?
>
> "Brock Allen" wrote:
>
>>> I think that I could put my authentication code in
>>> AuthenticateRequest event in either Global.asax or in a custom HTTP
>>> module. However, I don't know what is the difference between them.
>>> And is there any implication if I make the choice of one way or the
>>> other?
>>>
>> Authentication is done in your custom login page. Once you are
>> confident the user has provided proper credentials you then want to
>> call FormsAuthentication.SetAuthCookie or
>> FormsAuthentication.RedirectFromLoginPage. This will issue a cookie
>> that will identify the user.
>>
>> So, in short, you just need to build the login page.
>>
>> -Brock
>> DevelopMentor
>> http://staff.develop.com/ballen

Relevant Pages

  • Re: MS05-004: Path vunerability still present in ASP.NET 2.0
    ... -> redirect to login.aspx ... Dominick Baier - DevelopMentor ... indeed exist on this ASP.NET 2.0 web site hosted on a W2003 SP2 IIS ... ASP.NET picks-up the authentication / authorization and re-directs. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: ActiveDirectory authentication - more issues
    ... Dominick Baier - DevelopMentor ... I have ActiveDirectory authentication working but have a couple ... I do not get a WindowsIdentity but instead a FormsIdentity. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: XML Webservice authentication
    ... so you have a web application which already does authentication using forms and on some pages you call a webservice..? ... Dominick Baier - DevelopMentor ... technology, the only solution I can see is to use cookies, but I am ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Enabling Forms Authentication Stops Button Click Events
    ... my own wwwroot directory, problem solved. ... Dominick Baier - DevelopMentor ... I know it's form authentication related, ... I enable anonymous access every thing works great. ...
    (microsoft.public.dotnet.security)
  • Re: MS05-004: Path vunerability still present in ASP.NET 2.0
    ... Dominick Baier - DevelopMentor ... ASP.NET web sites that uee Forms Authentication. ... Today I've received a report from a third party doing penetration ...
    (microsoft.public.dotnet.framework.aspnet.security)