Take the 2-minute tour ×

I am creating my own blog engine in MVC3 and I don´t want to register users to post comments and other things. I just want to have login page for admin (me) so I don´t want to implement membershipprovider. I just want to have login page and [Authorize] atribute enabled and then logout link. What is best way to do this? Thanks

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

[Authorize] attribute relies on HttpContext.Current.User IPrinicipal object to verify whether user is authenticated or not. If you don't want to implement MembershipProvider then you will have to implement some type of your own IPrinicipal object. Another solution might be to go with FormsAuthentication with a web.config setting that looks something like this:

 <authentication mode="Forms">
    <forms loginUrl="~/Account/LogOn" timeout="2880">
        <credentials passwordFormat="SHA1">
            <user name="admin" password="43206512b209ba29cb5c642edc85bdac133354fe"/> <!-- SecretPass -->

Hope this help. Regards.

EDIT: I used online SHA1 hash generator http://hash.online-convert.com/sha1-generator

share|improve this answer
Thanks to you I found some articles about IPrincipal, I implement it and it is working, thanks very much. –  Bibo Aug 2 '11 at 8:55
You are welcome! I'm glad I was able to help you. –  Husein Roncevic Aug 2 '11 at 9:12
Is this not giving a hacker your password and telling them how its encoded? I'm not an expert in security, so please forgive me if I am wrong, but surely hackers would be able to gain access easily with this information? –  simonlchilds Aug 2 '11 at 9:18
Well, in reality you are right. But web.config is never served if requested. This was just a suggestion to Bibo. However, if Bibo implements an object of type IPrincipal then this would not be required in web.config. Additionally SHA1 algorithm is pretty hard to crack, but still possible with brute force. Good point csharpsi. –  Husein Roncevic Aug 2 '11 at 9:28
add comment

By using some hard coded password/user name or machine specific login (Admin module is available only a specific IP) is easy.

share|improve this answer
Can you give me link for some article to this solution? :) –  Bibo Aug 2 '11 at 8:09
add comment

Your Answer


