How to find out that the client is my customer?

Question

0.00/5 (No votes)

See more:

Hello Experts

Here is a scenario. My Project is a simple project that it could be Desktop Application; But because it should run in more than 8 station all over the city and they must connect to a same database I decided to develop an Asp.Net Application.

The main problem is that the customer asked me that no body should see even the log in webpage except my personnel.

The only way I can think about, is to get a unique key from their computers to authenticate them.
I do not know even if it is possible!

Any suggestion?

Good luck everyone

Posted 11-Nov-13 8:18am

Meysam Toluie

Updated 11-Nov-13 8:21am

v2

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

**Zoltán Zörgő** · Answer 1 · 2013-11-11T08:31:00

There is no actual hardware identifier you could use with confidence. You could use a smartcard or biometric identification. See these articles: http://www.atgi.com/dist/Implementing%20Smart%20Card%20Authentication%20and%20Authorization%20with%20ASP.NET.pdf[^], http://www.sharepointsecurity.com/sharepoint/sharepoint-development/biometric-authentication-for-sharepoint/[^]. But these are quite complicated approaches, are rather platform-dependent.

But you have an option that is quite platform-independent on client side: using client side certificates. See this for the start: http://support.microsoft.com/kb/315588[^].

OriginalGriff · Answer 2 · 2013-11-11T08:36:00

You can't get info about the client computer easily - it is possible, but it opens up security holes which it's difficult to plug up afterwise.

A better approach would be to send an email to each authorised user which contains a "click here" link to a "hardware validation" page on your site. If the link contains a query string which you check in your DB (a different Guid per user is good) and if it is correct and not used yet, writes an authorisation cookie to the client computer. You then check the cookie in your "normal" website and if ok, show the login screen or just treat them as logged in.

Sounds complex - but it isn't. The email link is just a standard HTML HREF with a query string:

HTML

<a href="http://MyDomain.com/validation.html?id=9dcb491f-0edc-46d7-bc5a-6994416179a7">Click here to validate</a>

In the page, all you have to do is read the query, check it against your DB and write a cookie. Simples!

How to find out that the client is my customer?

2 solutions

Solution 1

Solution 2

Add your solution here

Preview 0