I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions.

Namely I need to invoke a workflow and collect information from the end user (backup phone number, email address) after the user logs in using a custom form.

The only way I know to create a cookie-based session (without too much "innovation" on my part) is to use WIF.

  • What other standard objects can I use with ASP.NET MVC to create an authenticated session that works with non-windows user stores?

Ideally I can store "role" or claim information in the session object such as "admin", "departmentXadmin", "normalUser", or "restrictedUser"

The workflow would look like this:

  1. User logs in with username and password
  2. If the username and pw are correct a (stateless) cookie based session is created
  3. The user gets redirected to a HTML form that allows them to enter their backup phone number (for SMS dual factor), or validate it if already set.
  4. The user can then change their password using the form provided

The "forgot password" would look like this

  1. User requests OTP code to be sent to the phone
  2. User logs in using username and OTP
  3. If the OTP is valid and not expired then create a cookie based session and redirect to a form that allows password reset
  4. Show password reset form, and process results.
  • So you're using ASP.Net Membership, you just want a more complex password reset mechanism than what it allows?
    – Earlz
    Commented Jan 29, 2013 at 19:23
  • @Earlz No, I'm not using ASP.NET Membership.. though I investigated if it would support the specific Bank-style verification with a one time password, and it does not. Commented Jan 29, 2013 at 19:26
  • 1
    @makerofthings7: ASP.NET membership doesn't support it, but it's pretty easy to implement such a password reset function on top of asp.net membership. See Password Recovery without sending password via email
    – Brian
    Commented Jan 31, 2013 at 22:01
  • Just subclass the membership provider and implement your auth system beneath it. Password reset done in the way you're describing can happen through pretty much any way you choose. You don't need a session or any of that. Just a redirect to a secure page using a temporary access token. Commented Jan 29, 2014 at 3:49

2 Answers 2


First, check out the improved membership bits that were released with 4.5 -- it should be easier to implement custom options on top of than the old creaky structure.

In either case, you can do some very effective "let the membership providers handle the major authentication and use your own database to handle extensions." Even the old ones have a concept of account approval you can manage programmatically.

Another option would be to use ASP.NET's authentication bits but roll your own backing. You can start with this article to get some of the basics and add on parts from there.


I've worked on writing my own simple authentication system named FSCAuth. It's been out for a while, but it's by no means "guaranteed" secure. Anyway, if you're considering rolling your own authentication anyway(which is always risky), you might considering using my authentication framework as a jumping off point. It's designed to be trivial to extend, but only implement what people actually care about.

One of it's goals is to handle the cookie stuff for you and never leave you to mess with hash values(where you can make something insecure very subtely). However, your use case makes it sound like some modification would be in order.

I have a few "branches" of FSCAuth:

  1. BSD licensed with paid support option at Binpress
  2. Same copy as what's at Binpress but easily browsable at bitbucket
  3. Integrated into my custom MVC framework(BSD). Not quite compatible with old version, but this version is in active development(and currently experimental), where the others are probably dead(due to lack of interest) at bitbucket

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.