What are other ways to Authenticate and authorize users/page?

Question

There are multiple ways to authenticate/authorize users. I took a look at Oauth, token based, and identity authentication, and I didn't like any of them. What I ended up doing is when I come to let the user log in, I would run a SQL procedure, or run it against my Dbcontext and when a user successfully logs in, I would set a session variable to true. I fully understand all of the other authorization/authentication method but I feel like I want to own the code more.

So my main question would be, how secure is the code below? Or if I wanted to do it "manually", what other secure ways are there?

Page to only allow authorized users

if (HttpContext.Session.GetString(isAuthenticated) == true ) // authorized users only page
        {
            Response.Redirect("Login");
        }

Login would look like this

 public IActionResult OnPost()
    {
        var user = _context.UsersTableTest.FirstOrDefault(u => u.UserName == Username);

        if (user != null && user.PasswordHash == Password)
        {
            // Successful login logic
            HttpContext.Session.SetString("IsAuthenticated", "true");
            return RedirectToPage("/Index"); // Redirect to a protected page
        }
        else
        {
            ModelState.AddModelError("", "Invalid login attempt.");
            return Page();
        }
    }

Something like this in layout

 @if (isAuthenticated == "true")
                    {
                        <div>
                            <form method="post" asp-page-handler="Logout" class="form-inline">
                                <button type="submit" class="btn btn-link text-dark">Logout</button>
                            </form>
                        </div>
                    }
                    else
                    {
                        <div>
                            <a class="btn btn-primary" asp-area="" asp-page="/Login">Login</a>
                        </div>
                    }

Answer 1

The approach you're taking, where you manually manage user authentication and authorization using session variables and custom database checks, can work, but there are several security concerns that you need to check:

1. Storing plain passwords in the database is risky.Use strong encryption methods to secure passwords.
2. Managing sessions securely is crucial to prevent unauthorized access and attacks.
3. Implement safeguards against repeated login attempts (brute force attacks).
4. Building your own authentication means you need to keep up with security updates on your own.
5. DIY authentication can be complex and might lead to security oversights.
6. Custom methods might not align with industry standards, making it harder for others to understand your code.
7. Consider using JWT for more control while still following established standards.

Balancing control and security is important. Make sure you're not introducing vulnerabilities that could compromise user data or your application's security.