SimpleMembership.Mvc3 – 1.1 Published

A couple items.

1. There’s still a bug that keeps the Token from being returned. In AccountController.cs, line 89, could read: var token = WebSecurityService.CreateUserAndAccount(model.UserName, model.Password, requireConfirmationToken: requireEmailConfirmation); – otherwise the value get placed into the propertyValues parameter.

2. Is there a lot missing from the sample project? E.g. Where is the code for sending the confirmation email? How about the confirmation and password reset pages, etc? Are those missing ?

Thanks Adam – appreciate the quick response as well!

(If it were a debate I’d argue for 2 points:

1) that the main reason a developer would look for a package like this is to handle confirmations and password resets. Otherwise, the ASP.NET membership is adequate.

2) your strategy (choosing an unlikely name) works well for avoiding stepping on existing stuff. I’d argue that it’s pretty unlikely you’ll be stepping on anyone’s existing code/views if you stick with it.

Mike.

@Adam,

This is awesome! Thanks so much. I think this will save folks a lot of time. All they have to do is find it and the NuGet package really makes it easy.

Honestly, I can’t believe that confirmation, password reset, etc. isn’t included with base Asp.Net membership provider. I haven’t seen any updates saying that will change anytime soon so this is a great solution.

@Adam,

If it’s OK, I’ll make (5) suggestions. I think one of them is important:

1) minor – in App_Start\SimpleMembershipMvc3.cs I changed the connectionStringName
– from: “Default”
– to: “ApplicationServices”
since VS adds ApplicationServices automatically when you create a new Internet Application.

2) minor – in Web.Config – in the “” section, I added two items:
1)
to change the default lagin page that WebMatrix users to when a users tries to access a page that requires authorization.
2)

3) minor – in Services\MessengerService.cs I added a throw so that I know when email send fails:
catch (Exception ex)
{
//Log exception
throw ex;
}

4) important – when registering, if the UserName already exists, it throws an exception. To avoid this I added some code in AccountController.cs to check if the UserName’s taken. I also save the email address in propertyValues for the next suggestion.

if (ModelState.IsValid)
{
// Check whether the user already exists
if (WebSecurityService.UserExists(model.UserName))
{
ModelState.AddModelError(“”, “Username is already in use.”);
}

else
{
// Attempt to register the user
var requireEmailConfirmation = true;

// Save the email address in PropertyValues
var token = WebSecurityService.CreateUserAndAccount(model.UserName, model.Password, propertyValues: new { Email = Request["email"] }, requireConfirmationToken: requireEmailConfirmation);

if (requireEmailConfirmation)
{
// Send email to user with confirmation token
string hostUrl = Request.Url.GetComponents(UriComponents.SchemeAndServer, UriFormat.Unescaped);
string confirmationUrl = hostUrl + VirtualPathUtility.ToAbsolute(“~/Account/Confirm?confirmationCode=” + HttpUtility.UrlEncode(token));

var fromAddress = “yourEmailAddress@host.com”; // TODO: Edit fromAddress
var toAddress = model.Email;
var subject = “Thanks for registering but first you need to confirm your registration…”;
var body = string.Format(“Your confirmation code is: {0}. Visit {1} to activate your account.”, token, confirmationUrl);

// NOTE: This is just for sample purposes
// It’s generally a best practice to not send emails (or do anything on that could take a long time and potentially fail)
// on the same thread as the main site
// You should probably hand this off to a background MessageSender service by queueing the email, etc.
MessengerService.Send(fromAddress, toAddress, subject, body, true);

// Thank the user for registering and let them know an email is on its way
return RedirectToAction(“Thanks”, “Account”);
}
else
{
// Navigate back to the homepage and exit
WebSecurityService.Login(model.UserName, model.Password);
return RedirectToAction(“Index”, “Home”);
}
}
}

5) important*** – in ForgotPassword the user can enter any email address. This allows anyone who can guess a username to use ForgotPassword to reset the users password and essentially steal the users account.
So, I added some code to compare the email address they enter to the user entered when they created the account (saved in propertyValues above). If the 2 match, then the token is generated.

if (ModelState.IsValid)
{
var userID = WebSecurityService.GetUserId(model.UserName);
String SavedEmail = string.Empty;

if ( userID > -1 && WebSecurityService.IsConfirmed(model.UserName) )
{
using (var conn = new SqlConnection(WebConfigurationManager.ConnectionStrings["ApplicationServices"].ConnectionString))
{
using (var cmd = new SqlCommand(“Select Email from users where ID = ” + userID.ToString(), conn))
{
conn.Open();
var ret = cmd.ExecuteScalar();
SavedEmail = (ret is DBNull) ? string.Empty : ret.ToString();
}
}

if (SavedEmail == model.Email)
{
resetToken = WebSecurityService.GeneratePasswordResetToken(model.UserName);
isValid = true;
}
}

if (isValid)
{
string hostUrl = Request.Url.GetComponents(UriComponents.SchemeAndServer, UriFormat.Unescaped);
string resetUrl = hostUrl + VirtualPathUtility.ToAbsolute(“~/Account/PasswordReset?resetToken=” + HttpUtility.UrlEncode(resetToken));

var fromAddress = “yourEmailAddress@host.com”;
var toAddress = model.Email;
var subject = “Password reset request”;
var body = string.Format(“Use this password reset token to reset your password. The token is: {0}Visit {1} to reset your password.”, resetToken, resetUrl);

MessengerService.Send(fromAddress, toAddress, subject, body, true);
return RedirectToAction(“ForgotPasswordMessage”); // moved inside
}
}

Sorry, I should have said two are important.

Just out of curiosity, why use WebSecurity rather than SimpleMembershipProvider?

I see that WebSecurity includes InitializeDatabaseConnection, but SimpleMembershipProvider seems to be a superset of WebSecurity.

@Adam – thanks again.
>> you never use the membership provider directly because that would couple you to the specific implementation.
Good point – I should have realized before I posted.

The reason I asked was that I was looking for a way to avoid letting bad guys take over someone elses account by entering their own email address in the password reset screen (so that the password reset token would be sent to their email address rather than the owners).

SimpleMembershipProvider has GetUserNameByEmail (which I assume retrieves the email address that was originally entered by the owner – provided we save it in propertyValues). The code I posted above uses ADO.NET to retrieve the address.

Kinda seems like something’s missing in WebSecurity – or maybe I’m missing something or looking at it from a different viewpoint…

@Adam,

But all you have to do to steal someone elses account is go to the “Forgot Password” page:

1. Enter *** THEIR Username ***
2. Enter an email address *** YOU OWN ***

I just tried it – I created a new account:
1. Username: “MikeSmith”
2. Email: “MikeSmith@whitehat.com”

Then, I went to the “Forgot Password” page and entered:
1. Username: “MikeSmith”
2. Email “JoeCool@blackhat.com”

The password reset token for MikeSmith’s account was sent to JoeCool@blackhat.com.

JoeCool clicked the unique URL link and entered a new password for MikeSmith’s account. Now JoeCool is logged into MikeSmith’s account and MikeSmith can no longer log in since the password on his account has been changed by Joe.

The email address where the “password reset token” is sent isn’t validated at all. So the token can be sent anywhere.

Mike.

@Adam,

My plan is to use email address as the username to avoid the problem. That may be the best solution for the sample as well (for the reasons you mention).

Thanks for the heads-up on GetUserNameByEmail().

Keep up the great work!

@Adam,

Did you have a chance to update the sample?