User Authentication and Profiling in .NET

Generation GS1 - 13 in .NET User Authentication and Profiling

Microsoft Commerce Server 2000 provides support for an extensible profile system that can store a great deal of user data. This user data, or customer profile, can include shipping addresses and contact information. Customers can use these profiles to store personal data so that they aren t required to reenter the information each time they visit the site. Thereafter, a company can then use the profile information for business analysis, targeted advertising campaigns, and discount offers. To create and maintain a profile, a customer must register with the site and log on. This creates a unique user ID that identifies the user and retrieves the corresponding profile information from the database. The customer s user ID is stored in a cookie on the client browser. If a user has not yet logged on, the cookie contains the user ID associated with the anonymous user, and profile information is not available. When the user logs on, the appropriate user ID is retrieved and written to the cookie; thereby making the profile information available for the remainder of the session.

Note: Just as the Bdrefresh.asp script clears the Business Desk cache, the RefreshApp.asp script clears the Profiles cache. Clearing either of these caches repeatedly could lead to a denial of service for users.

The site requires browsers to be configured to allow cookies. If a user accesses the site with a browser configured to allow per-session cookies (cookies that are not stored on the user s hard disk) but not stored cookies, the user can log on and use the site but is not able to place products in the shopping basket. If no cookies are allowed at all, the user is not able to access the site.

A user can register with the site by using the Registration.pasp page. When this page is rendered using the Registration-IE5.xsl style sheet, it contains a form that posts the data back to itself. The Registration.pasp page contains code to perform the following tasks: 1. Examine the data in the form to determine the Mode and ProcessAction parameters. Mode is used to indicate the page the user should be redirected to when registration is complete (the default is Acct.pasp). ProcessAction is used to decide if the registration form should be displayed so that a user can register, or if the form is being posted back for processing. 2. Pass the registration data to the PutUserObject so that a new profile can be created. PutUserObject is defined in the Profile.asp include file. 3. Redirect the user to the Acct.pasp page (or another page determined by the Mode parameter). The Registration.pasp page retrieves the Mode and ProcessAction values from the query string by using the MSCSAppFrameWork application-level variable, as shown in the following code:

strPageMode = _ Application("MSCSAppFrameWork").RequestString( _ "Mode", Null, , , True, True, 0, Null) strProcessingAction = _ Application("MSCSAppFrameWork").RequestString( _ "ProcessAction", Null, , , True, True, 0, Null)

Mode is usually null, meaning that when a user successfully registers, he or she should be redirected to the account management page (Acct.pasp). In some circumstances, Mode contains the name of an alternate page to which the user should be redirected. For example, if an anonymous user adds products to a shopping basket before registering, you may want to send the user back to the checkout page after he or she registers. The ProcessAction parameter is used to determine whether the user accessed the registration page from another page in the site, in which case the registration form renders, or from the registration page itself, in which case the contents of the registration form are used to register the user. If the ProcessAction parameter is EditUserObject, then the user can be registered using the data in the form on the page. Next, the script retrieves the form data and passes it to the PutUserObject function, which is defined in the Profile.asp include file. This include file contains numerous