Search code examples
asp.netauthentication

User authentication database in App_Data folder - isn't that dangerous?

We're planning to use standard ASP.NET user authentication for our application. However, by default this requires us to have our user database on our web server in the App_Data folder.

This is usually a big no-no for us - our databases are all behind the firewall and all access is done via a WCF Service layer.

If the database was on a different server, but directly accessible from the web server then this still violates our usual architecture rules.

Should we worry about our user database living on our web server? Does ASP.NET offer an out-of-the-box alternative?

NOTE: We're using .NET 3.5 and SQL Server 2005

Solution

  • Yes, you should worry. No, there is no out-of-the-box solution. ASP.NET only ships with a SQL Membership Provider and an Active Directory membership provider (reference). You will have to use a custom membership provider to provide your functionality.