I am currently developing an HTML5/C# web app to replace an older ASP.NET forms app and after reading many blogs and posts I still do not understand the objectives, purposes, and weaknesses of the built in authentication schemes in ASP.NET. So if I implemented my own authentication/security in the following way, what would you change? IE - how would you be smarter and faster than me. (The app uses SignalR web socket and AJAX requests to drive the HTML5 front end).
- All users would be anonymous according to ASP.NET.
- User information would be stored in an app wide dictionary object.
- Login would be accomplished by server checking provided creds against a user table in the DB.
- Upon successful login server would generate token for client to store as long as I think is convenient and safe.
- Token would be sent with all requests so every request could be validated on the server and only appropriate actions be done (not sure if SignalR has a way to automagically add a token to every request)
- Server would have to manually expire tokens.
Would it be a good idea to enable the session state and store basic user info there so I don't have to manually expire the tokens? But then I would have to manually add the cookie data to SignalR requests right?
Honestly I'm more comfortable just rolling my own, especially since we have other apps (and other developers that don't like auth frameworks) that depend on our custom user table. The app is not public so we don't need anything fancy like OAuth or authentication servers.