Authentication and Authorization in ASP.NET MVC

Introduction:-

When you are developing any web application, the most important thing you need to take care of is its security. That means we need to ensure that only authenticated and authorized users can access our WebPages.

(User base is called authentication)

What is authentication:-

Authentication checks whether the incoming user is valid or not Authenticates the user This process is called authentication

There are different ways of authentication

1. Windows Authentication,

2. Form Authentication

3. Password authentication

Example:-

The question here is how to check if the user is valid or not. When a user comes to a website for the first time he will register for that website. All his information like username, password, email etc. will be stored in the website database. When a user enters his user ID and password, his information will be checked against the database. If the user has entered the same userid and password as in the database then he is a valid user and will be redirected to the home page of the website. If the user enters a UserID and/or password that does not match the database, the login page will display a message, "Enter a valid name or password". The entire process of checking whether a user is authorized to access a website is called authentication.

What is authorization:-

Authorization is role base, authorization will check what the role of the user is, if the user gets the authorization, he will be redirected to the page where the role is defined.

(Role base is called authorization)

Example:-

Once the user is authenticated he needs to be redirected to the appropriate page by his role. For example, when an admin logs in, he is redirected to the admin page. If an accountant is logged in, he will be redirected to his accounts page. If an end user is logged in, he will be redirected to his page.