Anonymous Personalization Trick in Web Parts

Introduction

ASP.NET 2.0 provides a Web Parts framework, allowing programmers to easily integrate drag ’n drop menus etc. in their web portals. This framework is easy to use and all client based design settings are stored by ASP.NET data providers in an easy way. The developer has nothing to do with the save or load process of Web Parts design based settings. This article will not cover how we can use Web Parts. It’s possible to find lots of articles around the web about Web Parts.

ASP.NET 2.0 Web Parts framework works with the Membership framework as well as the Forms or Windows authentication modes. The problem is that, if you don’t want to use any authentication mode, you can’t use Web Parts. The client user, who will able to change the web site's design with Web Parts, should be authenticated. If not authenticated, the ASP.NET Web Parts framework can’t save users' design settings with data providers and for that reason can’t allow even to switch design modes.

The Idea

If we just need that all users connecting to our web site be authenticated, we need to register all users to our web site's authentication system. We will use Forms Authentication and provide some tricky ways. Users will be registered with our site in a hidden way with some cookie. We will recognize our visitors with their cookie and authenticate them automatically to get Web Parts design options available for them.

Using Hidden Authentication

First, we will set up our web site for Forms Authentication. You just need to modify your Web.Config file as below:

        <!--
            The <authentication> section enables configuration 
            of the security authentication mode used by 
            ASP.NET to identify an incoming user. 
        -->
        <authentication mode="Forms" />

We will provide for each visitor a cookie to recognize the user's identity to be able to show them their design settings. We need an identity name for each visitor. We will create a random guide number to use as identity.

Dim MyCookieName As String = "Reminder"
Dim MyCookie As System.Web.HttpCookie = Request.Cookies(MyCookieName)
Dim UserID As String
UserID = System.Guid.NewGuid.ToString.Replace("-", "")
MyCookie = New System.Web.HttpCookie(MyCookieName, UserID)
MyCookie.Expires = DateTime.Now.AddYears(10)
Response.Cookies.Add(MyCookie)

Our cookie name is “Reminder”. You can change the name for your projects. Our Cookie data is the random guide name “UserID” that we generated using .NET Framework's “System.Guid.NewGuid” class. Now we can programmatically recognize our visitors each time they visit our web portal.

We should now authenticate our user with his GUID name "UserID" to our Forms Authentication system. In a normal situation ASP.NET uses cookies to store Forms Authentication data. We will just simulate that process manually.

Dim authTicket As FormsAuthenticationTicket = _
    New FormsAuthenticationTicket(1, UserID, DateTime.Now, _
    DateTime.Now.AddSeconds(30), False, "roles")
Dim encryptedTicket As String = FormsAuthentication.Encrypt(authTicket)
authCookie = New HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
Response.Cookies.Add(authCookie)

Now our user is authenticated to our web site with Forms Authentication and can access Web Parts design properties.

We will have lots of visitors designing our web site for themselves and then just never visit again our web site or just delete their cookie and loose their identity as well as their design settings. So why do we need to store all visitor design settings if they haven’t visited our web site since last year? With the code below we connect manually to the ASP.NET Membership data store and delete users settings and profile manually, checking the last activity date of the user.

Dim LastDate As Date = Date.Now.AddYears(-1)

Dim cnn As System.Data.SqlClient.SqlConnection = New _
  System.Data.SqlClient.SqlConnection(_
  ConfigurationManager.ConnectionStrings("LocalSqlServer").ConnectionString)
Dim cmd As System.Data.SqlClient.SqlCommand

cmd = New System.Data.SqlClient.SqlCommand("DELETE FROM" & _ 
      " aspnet_PersonalizationPerUser where UserID IN " & _ 
      "(SELECT UserID from aspnet_Users where " & _ 
      "[LastActivityDate] < @Date)", cnn)
cmd.Parameters.Add("@Date", Data.SqlDbType.DateTime)
cmd.Parameters.Item("@Date").Value = LastDate
Try
    cnn.Open()
    cmd.ExecuteNonQuery()
Catch ex As Exception
Finally
    cnn.Close()
End Try

cmd = New System.Data.SqlClient.SqlCommand("DELETE FROM" & _ 
      " aspnet_Users where [LastActivityDate] < @Date", cnn)
cmd.Parameters.Add("@Date", Data.SqlDbType.DateTime)
cmd.Parameters.Item("@Date").Value = LastDate
Try
    cnn.Open()
    cmd.ExecuteNonQuery()
Catch ex As Exception
Finally
    cnn.Close()
    cmd.Dispose()
    cnn.Dispose()
End Try

The complete solution is as below:

Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)

If Page.IsPostBack = False Then
    Dim authCookie As HttpCookie = _
        Request.Cookies(FormsAuthentication.FormsCookieName)
    If authCookie Is Nothing Then
        Dim MyCookieName As String = "Reminder"
        Dim MyCookie As System.Web.HttpCookie = _
                     Request.Cookies(MyCookieName)
        Dim UserID As String
        If MyCookie Is Nothing Then
            UserID = System.Guid.NewGuid.ToString.Replace("-", "")
            MyCookie = New System.Web.HttpCookie(MyCookieName, UserID)
            MyCookie.Expires = DateTime.Now.AddYears(10)
            Response.Cookies.Add(MyCookie)
        Else
            UserID = MyCookie.Value
        End If
        Dim authTicket As FormsAuthenticationTicket = New _
          FormsAuthenticationTicket(1, UserID, DateTime.Now, _
          DateTime.Now.AddSeconds(30), False, "roles")
        Dim encryptedTicket As String = _
            FormsAuthentication.Encrypt(authTicket)
        authCookie = New HttpCookie(FormsAuthentication.FormsCookieName, _
                                                        encryptedTicket)
        Response.Cookies.Add(authCookie)
        Response.Redirect(Request.Url.ToString)
    End If
    
    Dim LastDate As Date = Date.Now.AddYears(-1)
    
    Dim cnn As System.Data.SqlClient.SqlConnection = New _
      System.Data.SqlClient.SqlConnection(_
      ConfigurationManager.ConnectionStrings(_
      "LocalSqlServer").ConnectionString)
    Dim cmd As System.Data.SqlClient.SqlCommand
 
    cmd = New System.Data.SqlClient.SqlCommand("DELETE FROM" & _ 
          " aspnet_PersonalizationPerUser where UserID IN " & _ 
          "(SELECT UserID from aspnet_Users where " & _ 
          "[LastActivityDate] < @Date)", cnn)
    cmd.Parameters.Add("@Date", Data.SqlDbType.DateTime)
    cmd.Parameters.Item("@Date").Value = LastDate
    Try
        cnn.Open()
        cmd.ExecuteNonQuery()
    Catch ex As Exception
        Response.Write(ex.Message)
    Finally
        cnn.Close()
    End Try
    
    cmd = New System.Data.SqlClient.SqlCommand("DELETE FROM" & _ 
          " aspnet_Users where [LastActivityDate] < @Date", cnn)
    cmd.Parameters.Add("@Date", Data.SqlDbType.DateTime)
    cmd.Parameters.Item("@Date").Value = LastDate
    Try
        cnn.Open()
        cmd.ExecuteNonQuery()
    Catch ex As Exception
        Response.Write(ex.Message)
    Finally
        cnn.Close()
        cmd.Dispose()
        cnn.Dispose()
    End Try
End If

End Sub

The scenario starts with checking the Forms Authentication cookie. If we have already authenticated the user, we need not do anything. If there isn’t the Forms Authentication cookie, we check further if we have got our identity cookie. If there is an identity cookie “Reminder”, we can load the user's identity and authenticate it with Forms Authentication. This way, all users' old design settings comes automatically to our web portal. If the user doesn’t have our “Reminder” cookie, we create an identity and store it for that user and authenticate it with the new identity to the authentication system.

After having done all this process, we check for old users and delete the ones which don’t have at least one year activity on the web portal.

Conclusion

You just need to use this system on the "Page_Load" event of your web forms where you are using web parts design properties. Have fun using this tricky method on your future portal developments.