Comments on: ASP.Net MVC and Forms Authentication http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/ Improving my craft... Mon, 07 Dec 2009 20:47:46 -0800 http://wordpress.org/?v=2.8.4 hourly 1 By: Ryan http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-488 Ryan Thu, 27 Mar 2008 14:28:25 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-488 The NullReference exception is likely a result of the Request["ReturnUrl"]. It is a bit presumptuous of me to assume that you'll be arriving at the Login.aspx page from another page that was unable to authorize/authenticate you. You may wish to do a safer "get" of the ReturnUrl. As for the PrinciplePermission attribute, it wouldn't hurt to have a full solution for that, but I hadn't planned on it. I do agree that it's a bit more clean to apply the attribute see as changing your Routes would change your urls and, thus, the config authorization. I'll do what I can to post an example soon. The NullReference exception is likely a result of the Request["ReturnUrl"]. It is a bit presumptuous of me to assume that you’ll be arriving at the Login.aspx page from another page that was unable to authorize/authenticate you. You may wish to do a safer “get” of the ReturnUrl.

As for the PrinciplePermission attribute, it wouldn’t hurt to have a full solution for that, but I hadn’t planned on it. I do agree that it’s a bit more clean to apply the attribute see as changing your Routes would change your urls and, thus, the config authorization.

I’ll do what I can to post an example soon.

]]> By: Dewy http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-487 Dewy Thu, 27 Mar 2008 14:12:40 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-487 Hi Ryan, this is exatcly what I am looking for, well at least I think that it is. I am using the Preview 2 download and so I had to make some changes to the web.config file to ref those files instead. I also had to change the Html.Form parameters around as these have been altered I guess for Prev2. When I try to run my app, it goes into debug and stops on the User/Login.aspx and highlights the using statement and says that there is a NullReference exception. Its drving me nuts. Any ideas? Also, I have done a bit of searching on this and I have also seen that you can use the PrinciplePermission attribute on the controllers themselves or in a base class or whatnot and I like this idea better as this means that you don't have to use hard coded paths in the config file. Are you planning on updateing your example to use the new release? Cheers Dewy Hi Ryan, this is exatcly what I am looking for, well at least I think that it is. I am using the Preview 2 download and so I had to make some changes to the web.config file to ref those files instead. I also had to change the Html.Form parameters around as these have been altered I guess for Prev2.

When I try to run my app, it goes into debug and stops on the User/Login.aspx and highlights the using statement and says that there is a NullReference exception. Its drving me nuts. Any ideas?

Also, I have done a bit of searching on this and I have also seen that you can use the PrinciplePermission attribute on the controllers themselves or in a base class or whatnot and I like this idea better as this means that you don’t have to use hard coded paths in the config file. Are you planning on updateing your example to use the new release?

Cheers
Dewy

]]> By: Ryan http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-486 Ryan Mon, 04 Feb 2008 03:30:28 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-486 Count me in! I'd love to make it there regardless, but a beer only helps the case. Count me in! I’d love to make it there regardless, but a beer only helps the case.

]]> By: Jesper Christiansen http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-485 Jesper Christiansen Sun, 03 Feb 2008 20:54:25 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-485 Thank you soo much! That gave me a few gray hairs trying to solve that one :) (Im still a little new in the asp.net world) .. if you ever stop by Copenhagen, Denmark - I owe you a beer! :) Thank you soo much! That gave me a few gray hairs trying to solve that one :) (Im still a little new in the asp.net world) ..

if you ever stop by Copenhagen, Denmark – I owe you a beer! :)

]]> By: Ryan http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-484 Ryan Sun, 03 Feb 2008 20:00:04 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-484 Jesper, It likely did create the database, but, initially, it's not added to the project in the sense you may be expecting. The SQL Express MDF is likely just not "included" in the Visual Studio project. In the Solution Explorer, there is a button at the top called "Show All Files". Click that and see if the ASPNETDB.mdf is not in the App_Data directory. Jesper,

It likely did create the database, but, initially, it’s not added to the project in the sense you may be expecting. The SQL Express MDF is likely just not “included” in the Visual Studio project. In the Solution Explorer, there is a button at the top called “Show All Files”. Click that and see if the ASPNETDB.mdf is not in the App_Data directory.

]]> By: Jesper Christiansen http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-483 Jesper Christiansen Sun, 03 Feb 2008 19:38:17 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-483 Hmm.. I simply dont get it! I can easily add users and roles in the "Web Site Administration" web-interface.. but it never creates a database for me.. Atleast not under my current project.. Any idea of what I might be doing wrong? It seems to by working on projects that are not MVC websites. Hmm.. I simply dont get it! I can easily add users and roles in the “Web Site Administration” web-interface.. but it never creates a database for me.. Atleast not under my current project..

Any idea of what I might be doing wrong? It seems to by working on projects that are not MVC websites.

]]> By: Ryan http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-482 Ryan Tue, 08 Jan 2008 13:40:49 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-482 You can do a number of things. You can authorize the Edit url itself by using /Products/Edit as the location element. You can authorize the Edit ControllerAction method via the PrincipalPermission attribute. Of course, you could do it manually in code as well by asserting role membership. You can do a number of things. You can authorize the Edit url itself by using /Products/Edit as the location element. You can authorize the Edit ControllerAction method via the PrincipalPermission attribute. Of course, you could do it manually in code as well by asserting role membership.

]]> By: Israel Aece http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-481 Israel Aece Tue, 08 Jan 2008 11:33:17 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-481 Hello Ryan, What's the solution when we need to protect the URL like /Products/Edit/1 where "1" is a productId? Hello Ryan,

What’s the solution when we need to protect the URL like /Products/Edit/1 where “1″ is a productId?

]]> By: Ryan http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-480 Ryan Wed, 02 Jan 2008 16:24:55 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-480 I don't have my sample here at the office, but I'll verify this evening. My current project using this tehcnique does include two actions within the same controller (ResourceController) which are authorized differently. The resource/upload action is only available to authenticated users, while resource/list is available for all users, including anonymous. I will confirm this and try to post an updated sample this evening. Do you have a specific reason or example why you feel this doesn't work as expected? You may wish to add the trailing slash. I don’t have my sample here at the office, but I’ll verify this evening. My current project using this tehcnique does include two actions within the same controller (ResourceController) which are authorized differently. The resource/upload action is only available to authenticated users, while resource/list is available for all users, including anonymous. I will confirm this and try to post an updated sample this evening.

Do you have a specific reason or example why you feel this doesn’t work as expected? You may wish to add the trailing slash.

]]> By: Paul http://blog.cromwellhaus.com/index.php/2007/12/asp-net-mvc-and-forms-authentication/comment-page-1/#comment-479 Paul Wed, 02 Jan 2008 16:17:01 +0000 /blogs/ryanc/archive/2007/12/19/asp-net-mvc-and-forms-authentication.aspx#comment-479 Your technique works, however, it will only work a the controller level. If you want to secure an action, it won't work. For example, if you had secure/admin and secure/index. If you only want secure/admin to be secured you'd add <location path="secure/admin">. This does not work as expected. ~ Paul Your technique works, however, it will only work a the controller level. If you want to secure an action, it won’t work. For example, if you had secure/admin and secure/index. If you only want secure/admin to be secured you’d add . This does not work as expected.

~ Paul

]]>