Where to store user data after login with WebForms

authentication, c#, cookies, session

Solution

In the interest of easier debugging, I suggest using the Session Facade design pattern, described here, that will allow you to store the current user's data using the `HttpContext.Current.Session` object in a more organized fashion.

For instance, there would be a file (e.g., `SessionFacade.cs`) that is responsible for handling the values passed to/from the `Session`; in your case, it might look like:

public static class SessionFacade
{
    public static int UserId
    {
        get {
            if (HttpContext.Current.Session["UserId"] == null)
                HttpContext.Current.Session["UserId"] = 0;
            return (int)HttpContext.Current.Session["UserId"];
        }
        set {
            HttpContext.Current.Session["UserId"] = value;
        }
    }
    // ... and so on for your other variables
}

Then, somewhere else in your code, once you check that credentials are okay, you can do...

if (credentialsAreOk) {
    SessionFacade.UserId = /* insert ID here */
    // ...
}

...instead of manually assigning values to the Session object. This ensures your variables in `Session` are of the correct type, and will be easier to track while debugging. Then, to get the UserId from anywhere in your program, it's just `SessionFacade.UserId`.

(yes that snippet was from Eduard's answer; you should still look into that answer as it is informative as to how WebForms work; just keep in mind that calling the `Session` object manually in your code can be quite messy and that the Session Facade makes that process cleaner)

Problem

I'm developing a WebForms web application with VS2010 in C#. I use my custom login approach to authenticate users and I don't want to use Membership framework. After user login I want to store user data as userId, username, surname, email, etc., so I can access them during the user session in all pages. How can I do that? I don't wanna store user data in the `UserData` property of the `FormsAuthenticationTicket`. I found this approach: Should I store user data in session or use a custom profile provider?, but I don't understand how to implement it. I have some question: 1)in my login page to authenticate user after check credentials on db I use : FormsAuthentication.SetAuthCookie(txtUserName.Value, true); now in my default page I have: FormsAuthenticationTicket ticket = ((FormsIdentity)(User.Identity)).Ticket; and I use ticket.Name to show username. is it correct? why do you talk about thread using Thread.CurrentPrincipal.Identity.Name ? 2) I have this code in global.asax file to read user roles and store thems into HttpContext: void Application_AuthenticateRequest(object sender, EventArgs e) { ``` if (Request.IsAuthenticated) { SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["SQLConnStr"].ConnectionString); conn.Open(); SqlCommand cmd = new SqlCommand("SELECT Gruppi.Name FROM Ruoli INNER JOIN Gruppi ON Ruoli.GroupID = Gruppi.GroupID INNER JOIN Utenti ON Ruoli.UserID = Utenti.UserID AND Utenti.Username=@UserName", conn); cmd.Parameters.AddWithValue("@UserName", User.Identity.Name); SqlDataReader reader = cmd.ExecuteReader(); ArrayList rolelist = new ArrayList(); while (reader.Read()){ rolelist.Add(reader["Name"]); } // roleList.Add(reader("Name")) string[] roleListArray = (string[])rolelist.ToArray(typeof(string)); HttpContext.Current.User = new GenericPrincipal(User.Identity, roleListArray); reader.Close(); conn.Close(); } } ``` can I store user data into session as you wrote from my global.asax file rather then login.aspx page?

Original source