2

I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.

Not wanting to rollout my own crypto, of course, I'm using PBKDF2 for authenticating the user's password. But this is where I'm stuck. I assume that now I need to create some temporary ID and have the client and server use that until some time expires without client action. But I can't seem to find a source for this as most articles I've seen deal with ready made libraries.

So - am I correct? And if you have some source or more pointers, that would be welcome.

Improve this question
6
  • Would sessions do the trick? – vidarlo Jul 10 '18 at 16:21
  • Thanks. I'll look into it. But from a first look, it seems that it relies on the client being a browser with cookies etc. being taken care of automatically. As I said, I'm talking about an application. – ispiro Jul 10 '18 at 16:35
  • 1
    Use the same approach. Generate some random identifier you hand to the client, and store this and any information identifying the session on the server. The client can subsequently use this random identifier to authenticate communications. – vidarlo Jul 10 '18 at 16:51
  • Not my area of expertise, but it seems like you need something that combines ideas from user/pass auth + api keys, but you want a temporary api key that is issued after login. This is starting to sound a lot like a session cookie ... – Mike Ounsworth Jul 10 '18 at 17:36
  • @vidarlo Thanks. I thought as much, but wanted some confirmation (which I failed to find by searching). – ispiro Jul 10 '18 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.