private void authenticate()
{
string _username = null, password = null;
if (getVariable("username", var.POST) != null && getVariable("password", var.POST) != null)
{ //check for POST vars from the login form
_username = sanitize(getVariable("username", var.POST), clean.DB);
password = FormsAuthentication.HashPasswordForStoringInConfigFile(getVariable("password", var.POST), "MD5");
}
else if (Session["blogUsername"] != null && Session["blogPassword"] != null)
{ //check for sessions
_username = sanitize(Session["blogUsername"].ToString(), clean.DB);
password = sanitize(Session["blogPAssword"].ToString(), clean.DB);
}
else
{ //check for cookies
HttpCookie usernameCookie = HttpContext.Current.Request.Cookies["blogUsername"];
HttpCookie passwordCookie = HttpContext.Current.Request.Cookies["blogPassword"];
if (usernameCookie != null && passwordCookie != null)
{
_username = sanitize(usernameCookie.Value, clean.DB);
password = sanitize(passwordCookie.Value, clean.DB);
}
}
if (_username == null || password == null)
{
return;
}
string select = "SELECT userid, username, displayName, email, showEmail, createDate, accessLevel " +
"FROM users WHERE username='" + _username + "' AND password='" + password + "'";
SqlDataReader dr = query(select);
if (dr.HasRows)
{
dr.Read();
loggedIn = true;
userid = Convert.ToInt16(dr["userid"]);
username = Convert.ToString(dr["username"]);
displayName = Convert.ToString(dr["displayName"]);
email = Convert.ToString(dr["email"]);
showEmail = (Convert.ToInt16(dr["showEmail"]) == 1) ? true : false;
createDate = Convert.ToDateTime(dr["createDate"]);
accessLevel = Convert.ToInt16(dr["accessLevel"]);
cookie(true, password); //set cookies and sessions
}
else
{
loggedIn = false;
if (getVariable("username", var.POST) != null && getVariable("password", var.POST) != null)
{
loginFailed = true;
}
cookie(false, null); //remove any sessions or cookies
}
dr.Dispose();
}
private void cookie(bool set, string password)
{
HttpCookie usernameCookie = new HttpCookie("blogUsername");
HttpCookie passwordCookie = new HttpCookie("blogPassword");
switch (set)
{
case true:
//set cookies
usernameCookie.Value = username;
passwordCookie.Value = password;
usernameCookie.Expires = System.DateTime.Now.AddHours(24);
passwordCookie.Expires = System.DateTime.Now.AddHours(24);
HttpContext.Current.Response.Cookies.Add(usernameCookie);
HttpContext.Current.Response.Cookies.Add(passwordCookie);
//set sessions
Session["blogUsername"] = username;
Session["blogPassword"] = password;
break;
case false:
//set cookies to expire yesterday
usernameCookie = HttpContext.Current.Request.Cookies["blogUsername"];
passwordCookie = HttpContext.Current.Request.Cookies["blogPassword"];
try
{
usernameCookie.Expires = DateTime.Now.AddDays(-1);
HttpContext.Current.Response.Cookies.Add(usernameCookie);
}
catch { }
try
{
passwordCookie.Expires = DateTime.Now.AddDays(-1);
HttpContext.Current.Response.Cookies.Add(passwordCookie);
}
catch { }
//kill sessions
Session.Abandon();
break;
}
}
Let's begin partially through the
authenticate() method. You can see that in the successful authenticate decision, the last thing I do is call a new method called
cookie() set to true and with the
password sent as the second string variable. In the login failure decision, I also call
cookie() but set to false and a null in the second variable.
Next for the
cookie() method, what we do is create two cookie objects, one called
blogUsername and the other called
blogPassword. If the first method variable (
set) is true, we use the code to set
usernameCookie to the
username variable and
passwordCookie to the
password variable. Please notice that the
password is already md5 hashed. We're not setting it to the plain-text password. We also set
Session["blogUsername"] and
Session["blogPassword"], which are session variables. Session variables are basically variables you can set on the server... they're actually small 'cookies' of a sort that expire relatively quickly. Cookies, on the other hand, are set on the client and can last an arbitrarily large amount of time. In this case, we're setting them to last 24 hours.
In the false case, I'm getting the
blogUsername and
blogPassword cookies, then setting them to expire yesterday. This makes the user's browser delete them. I've wrapped the statements in try/catch statements because if the cookies don't exist, this would throw an exception. I then invoke
Session.Abandon() to kill the session variables.
