User authentication without Session state in ASP.NET

Question

One of the requirements proposed for an ASP.NET application is that we have Session state disabled globally. (This is not negotiable.)

Another requirement is that we have some means for user authentication. I'm thinking of using ASP.NET's membership provider model.

Is it possible to have user authentication without Session State?

The specific user-authentication examples we're looking for are:

• User goes to website unauthenticated
• User enters registration information (contact fields, etc)
• For the remainder of their session, user has access to certain content thanks to their registered status

Is there a way to do this with cookies?

Can this be done securely, so the cookie can not be easily spoofed?

Is there built-in functionality in ASP.NET to support this, or will we need to roll our own method?

Answer 1

ASP.NET Forms authentication does not use SessionState. It uses a cookie to store the authentication ticket.

You can also force the authentication ticket to be sent over SSL channel by editing the web.config file.

All the functionality you need is available built-in in ASP.NET.

http://msdn.microsoft.com/en-us/library/aa480476.aspx

Answer 2

Sure, a cookie will do this.

Think of the fundamentals. Session State is managed by cookies anyway.

Here's what you do.

When they log in, you take their userid, and a timeout (so the login only lasts for, say, 30 minutes or whatever).

Take that string, and hash it.

(java, not important tho)

String cookie = userid + ":" + timeString + ":" + md5(userid + ":" + timeString + ":" + "secretpassword");

Then, when the request hits your site, check the cookie. First check it for integrity.

String parts[] = cookie.split(":");
String newHash = md5(parts[0] + ":" + parts[1] + ":" + "secret password");
if (!newHash.equals(parts[2])) {
    // boom, cheater!
}

Then check the time string to see if they're still "logged in", and go from there.

Make sure if you do the time thing to update the cookie on every request.