Wednesday, 7 August 2013

Storing/Tampering User ID in my.settings

Storing/Tampering User ID in my.settings

I am thinking about administrator authentication, and I am curious about
storing my user's ID at login from a textbox under something like
my.settings.EmployeeID. I then want to pass this back to my database to
see if they have a certain permission level (so lets say a checkbox
indicator for "admin" exists in the database, so return a true or false),
create a method to send my.settings.employeeID to the database and get the
true/false value.
My main concern is that, a user theoretically could locate the file to
which the settings are saved, and after login, change the value of the
employeeID setting to that of a current administrator. My first thought is
to create some sort of encrypt/decrypt method that will store the string
in the file in something other than plain-text.
Question is, am I going about this the right way? Or would there be a
simpler way to plan authentication?

No comments:

Post a Comment