Kevin Junghans

I while back I wrote an article " Decoupling You Security Model From The Application Model With SimpleMembership ".  In this article I proposed a design change to how the AuthorizeAttribute is used that provides a decoupled security model that is more flexible as your ASP.NET MVC application evolves.  One reader provided good comments on what he did not like about the design, with one major issues being the use of magic strings to define the resources and operations that we are authorizing against.  If you recall from the previous article we define the custom AuthorizeAttribute like this. [SimpleAuthorize(Resource = "UserProfile", Operation = "modify")] public ActionResult ModifyUserProfile() { ViewBag.Message = "Modify Your Profile"; return View(); } This is a valid concern so I revisited this design and came up with a solution that eliminates magic strings and will actually perform better. Here is what our S...

I had a couple of enhancement requests in the VoiceModel Project around making user recordings.  The first request was to allow the directory that holds the recordings to be specified as a file structure or file share. And the second request was to allow multiple recordings in a single session.  I finally got some time to look at implementing these enhancements and was pleasantly surprised that the features were already in place because of the flexibility in the VoiceModel architecture and state machine. Well, for the most part. I will explain one little change I had to make to VoiceModel to get this to work. To test this out I updated the RecordingExample project in the VMWithExamples solution. You can get the source code here . Basically my solution was to add an On-Exit-Action to the recording state that copies the recorded file to another location.  This satisfies the request to be able to put recording in another location, including a file share.   Here is ...

I was working on a web project using ASP.NET MVC 4 when I started seeing some strange behavior. Some of my AJAX calls to ASP.NET Web API services were getting redirected back to the same URL. The only difference between the original URL used to make the call and the redirected URL was changes in case sensitivity. While this could just be annoying and cause some performance issues this was causing my application real issues because the redirected web request was missing some header information.  Specifically I was using basic authentication on the calls to the Web API's  and the header was missing the authentication information and therefore this was causing the requests to fail authentication/authorization.  For the life of me I could not figure out what was causing the redirects. Then I started thinking back to what had changed in the application that may have introduced this behavior.  I had added the use of the SessionAuthenticationModule so that I could store c...

One of the peeves I have with ASP.NET MVC and  how security is handled is that you have to design your security model up front while you are designing your web application.  You have to determine which roles you need to have while implementing your application so that you can add them to the Authorize attribute on the controllers actions.  Here is an example of how you control access to controller actions. [Authorize(Roles = "admin,user")] public ActionResult DoSomething() { ViewBag.Message = "Do something really spectacular."; return View(); } Now when we want to change our security model, such as adding new roles, we have to go through the whole application changing these Authorize attributes, recompile the application, and redeploy. This coupling causes a lot of inefficiencies. But you can customize SimpleMembership to handle this in a better way that decouples the security model form your application domain. I will demons...

In previous posts I have written about customizing and seeding SimpleMembership , the newest membership provider used in ASP.NET MVC 4 Internet applications.  In the example in this previous post we setup a database initializer that can be set to either to a type of DropCreateDatabaseAlways or  DropCreateDatabaseIfModelChanges .  As the name implies DropCreateDatabaseAlways will drop the database and recreate it every time the initializer is called, which is at application start, and will run the method to seed the database after creation.   DropCreateDatabaseIfModelChanges varies in that it will only recreate the database if the database model changes in your code.  Both of these approaches work great during development and unit testing but you would not want to deploy the solution this way for production.  This is where code-first migration comes in. Code-first migration allows you to update the database without having to recreate it and there...

Someone recently asked on StackOverflow if you can use the SimpleMembership provider in a mobile application generated by the mobile template for ASP.NET MVC 4.  The shell of the mobile application generated by this template generates basic security, such as logging in, logging out, registration and password reset, but it uses the older ASP.NET membership and role providers.  So I thought this would be a good exercise to see if I could use the open source project SimpleSecurity to switch the mobile application to use the SimpleMembershipProvider.   SimpleSecurity helps decouple SimpleMembership from an MVC application .  It turns out that it was quite easy to add SimpleMembership to an ASP.NET MVC mobile application when using SimpleSecurity . First add the SimpleSecurity assembly as a reference in your mobile project. You will also need to add WebMatrix.Data and WebMatrix.WebData as references. In the properties for these two assemblies set the property Copy L...

SimpleMembership is the new security provider that is bundled with ASP.NET MVC 4 when you use the Internet Template to create a new application.  In this article I will demonstrate how to add password reset to your MVC application using SimpleMembership. For this demonstration I will use SimpleSecurity , an open source project that decouples SimpleSecurity from your MVC application . The concepts in this article still apply if you do not use SimpleSecurity and you just want to use SimpleMembership directly. The basic steps for changing a password when using SimpleMembership is to first generate a unique token that is emailed to the user as a link.  Then the user clicks on the link passing the token in the query string. The user is presented with a web page to enter the new password and when they submit it the token is verified and if it passes the new password is updated in the users membership information. This method of password reset is very flexible since it can be used ...