authentication - Persistent login implementaion in ASP.NET MVC application -

i want implement type of authentication explained here in asp.net mvc application. http://jaspan.com/improved_persistent_login_cookie_best_practice

my current implementation having users , userlogintokens tables:

create table [users].[users] ( id              int             not null,  username        nvarchar(30)    null,   -- not unique. login email. email           nvarchar(100)   not null,  passwordhash    nvarchar(512)   not null, passwordsalt    nvarchar(512)   not null, ) create table [users].[userlogintokens] ( id          int             not null, userid      int             not null, token       varchar(16)     not null, series      varchar(16)     not null, ) 

after user log in, issued user cookie content: t=@token&s=@series.

now, have persistentloginmodule search cookie each request, validate token , series valid build user it.

my questions:

1. in order implement this, idea implement own authentication module , don't use formsauthentication @ all?

2. should validate token against db in each request?

3. when should discard old token , issued user new one?

4. regarding implementation of db, if understand correctly series same, given user. if so, maybe should move user table?

thanks, appreciate!

if you're going build own authentication module, recommend still using formsauthentication ticket.

the formsauthenticationticket class has userdata property can use store additional data.

you can use static formsauthentication.encrypt(ticket) , formsauthentication.decrypt(ticket) methods store , retrieve data set in cookie.

no. don't want go database on every request. might want store hash of provided evidence in kind of session variable (after you've verified against database). later recompute hash , compare value you've verified during current session (to verify hasn't been tampered with).

you should research on best practices , authentication hacking. article linked 2006. there has been lots of changes in web security since then.

check source code formsauthenticationmodule see how microsoft implementation works (using reflector). should make sure kb patch installed http://support.microsoft.com/kb/2416472