How do you implement Forms authentication in MVC?

Question

When using razor views, do you have to take any special steps to proctect your asp.net mvc application from cross site scripting (XSS) attacks?

Answer 1

Forms authentication is implemented the same way as we do in ASP.NET. So the first step is to set authentication mode equal to forms. The “loginUrl” points to a controller here rather than page.

<authentication mode="Forms">
<forms loginUrl="~/Home/Login" timeout="2880"/>
</authentication>

We also need to create a controller where we will check the user is proper or not. If the user is proper we will set the cookie value.

public ActionResult Login()
{
if ((Request.Form["txtUserName"] == "QueryHome") && (Request.Form["txtPassword"] == "QueryHome@123"))
{
             FormsAuthentication.SetAuthCookie("QueryHome",true);
             return View("About");
}
else
{
             return View("Index");
}

}

All the other actions need to be attributed with “Authorize” attribute so that any unauthorized user if he makes a call to these controllers it will redirect to the controller ( in this case the controller is “Login”) which will do authentication.

[Authorize]
PublicActionResult Default()
{
return View();
}
[Authorize]
publicActionResult About()
{
return View();
}