title: custom authentication in asp.net
body: <p>What is the best way to set up authentication against a custom database of users, in ASP.NET? My current setup is not great, and I am sure that there is a better way to do authentication, but all I can find are some articles that are seven or eight years old. My current setup is as follows:</p>
  
  <ul>
  <li>Application uses the Windows username (via Windows Authentication), to work out whether a user is in a database of allowed users. This is done via a call to an Authenticate method in  Page_Load.</li>
  <li>If the user isn't in the allowed users, then the page redirects to a login screen.</li>
  </ul>
  
  <p>The flaw with this method is that it calls:</p>
  
  <pre><code>Response.Redirect("~/login.aspx", false)
  </code></pre>
  
  <p>Which executes the entire body of the Page_load method. Is there a better way of doing authentication? Would something like custom Page classes, or HTTPModules do the job?</p>