FAQ
Q: I have to use a legacy database.Can I still take advantage of FSCAuth?
A: YES! FSCAuth was designed to work just as well with a database not explicitly designed for it. The only constraint is that there must be a UniqueID that will fit into a string for each user. Because you have control over each field in UserData you can also override things and make it so that FSCAuth will work across a plain text database. However, I don't recommend it and instead recommend you just reset all of your passwords and add a Salt column to your database if one doesn't exist yet.
Q: What if a user needs to recover their password?
A: The only way to recover a password is to store it in plain text or encrypted. As such, this is not supported for this library. I recommend instead generating a random password and sending this to the user instead so that they can reset their password to what they wish.
Q: How do I change the Hashing Algorithm? Why do I need a delegate?
A: To give you full control over how hashes are created and to accomodate "tracked" salts as used in BCrypt, you must create a new function and assign it to HasherInvoker. This is the default hasher:
static HashWithSalt DefaultHasher(string plain, string salt)
{
var v=new HashWithSalt();
if(salt==null){
v.Salt=HashHelper.GetSalt(SaltLength);
}else{
v.Salt=salt;
}
HashAlgorithm hash;
if(SupportsUnmanagedCrypto){
hash=new SHA256CryptoServiceProvider();
}else{
hash=new SHA256Managed();
}
v.Text=HashHelper.FromBytes(hash.ComputeHash(HashHelper.ToBytes(plain+v.Salt)));
return v;
}
With this, it should be simple to implement any hashing algorithm.
Q: What if I want the UniqueHash stored in my web.config?
A: Don't fill in Authentication.UniqueHash in the code, and the FSCAuth library will look in your web.config under appSettings. For instance, if this is in web.config, it will use myhash as the value of UniqueHash:
<appSettings>
<add name="FSCAuth_UniqueHash" value="myhash" />
</appSettings>
Note: This doesn't work under most Medium Trust installations, so for medium trust you must populate it in code.
Q: How do I use HTTP Basic Authentication?
A: If you only want it for one page and not every page, then in the Page_Load(or similar) just use Authentication.RequiresLogin(true);. The true option means to use Basic Auth. If no one is logged in, then at this line it will send the HTTP 401 Authentication Required erorr code.
If, however, you prefer to use HTTP Basic Auth "by-default", then use Authentication.UseBasicAuthByDefault=true;. This will make it so Authentication.RequiresLogin(); will use Basic Auth. To use cookie based authentication instead somewhere else, you can use Authentication.RequiresLogin(false);
Q: Can I have more than the fields you provide for UserData or GroupData?
A: Yes! All that must be done is descend from the class and use your new class in the UserStore. Note: Not every UserStore will require modifications to persist the extra fields, however, the provided SQL Server UserStore will require modifications to persist the extra fields.
Q: How can I protect static files?
A: Right now, it's not the easiest thing in the world. I plan to make this easier in the next release, but here is how to work around it:
Assuming IIS 7 or Apache(or some other server which always calls Global.asax even for static file requests), you must match the requested path against a regular expression or similar:
protected virtual void Application_BeginRequest (Object sender, EventArgs e){
if (Context.Request.Path.ToLower() == "/private")
{
Authentication.RequiresLogin();
}
}
Q: What if I want to change my hashing algorithm or UniqueHash?
A: Currently, it's not possible without resetting every user's password. However, there is a small bit of a workaround. You can modify things so that when a user logs in, since you know their password because it solved the old hash, you can set the new hash using the password they just logged in with. FSCAuth doesn't have this functionality built in however.
Q: Can I use bcrypt as my hashing algorithm?
A: Yes! Just follow these instructions
Q: Why don't you provide more UserStores?
A: I don't plan on providing any more past Memory, SQL Server, and MongoDB. The reason is because UserStores usually have to be implemented from scratch regardless to fit with how your website is designed. I don't want to provide code that has no use.
Q: Why are people logged into my site using Basic Authentication?
A: Basically, whenever a user logs in initially through Basic Authentication, the web browser sends the user credentials on every page requested. If you have HttpRealm set, then this enables code that will check the credentials the browser sends and log in the user if it's the correct login information. It is not possible to limit some pages to only cookies and some pages to only Basic authentication within the same website. (note: if you send RequiresLogin(false) then you won't get an HTTP Basic login prompt, but if you were to force your web browser to send the Basic Authentication headers, they'd log you in)
Q: Why can't I log out a user that logged in using Basic Authentication?
A: This is by fault of the HTTP standard. Basically, there is no way for your server to send a message to the user's web browser that it should stop sending credentials. You can see this Stackoverflow question for a work around though.
Q: Can I limit how many times a user can try to login?
A: Not at the moment. I've been working on an extension which will only let users attempt to login a set amount of times with it getting exponentially slower with each failed attempt, but currently it's not ready for production use. I plan on putting it in with the next release however.
Q: Do I need to transport everything over HTTPS?
A: Short answer; Probably. Unless you are using throw away credentials that don't actually matter, then use HTTPS at least when you POST back to login. If you use HTTP Basic authentication, you NEED to use HTTPS for everything because the username and password is sent over in clear text for every single request. It's not technically required, but it's defeating all of your security if you don't use HTTPS where user credentials are sent.
Q: Where format does the UniqueHash property have to be in?
A: It doesn't matter. Just make sure it's long and no one can guess it. I personally prefer to use Random.org to generate me a random string.
Q: Can I cache items in the UserStore?
A: You must be careful about it, but you can. The only concern you should have is that if you delete a user or change their information(especially password hash and/or salt), then you must be sure to flush the cache for that user. This is extremely simple to do in a single server setup, but more care must be taken in a multi-server setup.
Q: I have an odd condition where I need to put in a user not authorized message. How do I do that?
A: Just do throw new HttpException(403, "Forbidden"); For instance, to block a certain user from a page
if(CurrentUser.Username=="Bobby Drop Tables"){
throw new HttpException(403, "Forbidden");
}
Note: If you have a "catch-all" type error page, be sure that you set it up both as the 500(catch all), 403, and 401 error pages in the web.config, otherwise, you'll have the problem described below.
Q: What does the CustomErrorsFixer class do?
A: This class will fix a bug in some configurations of ASP.Net/mono in which instead of showing the current error page with the correct HTTP status code, instead it will do an HTTP redirect to the error page. This causes a massive amount of SEO problems including search engines indexing your login page and other pages that shouldn't be indexed. Pages which aren't anonymously accessible will be indexed in the search engine as either your login page or your 403 Forbidden page. Due to problems in medium trust, this class won't work within a medium trust environment. You should setup a robots.txt file to mitigate this problem in medium trust.
