title: Is there any real benefit to using ASP.Net Authentication with ASP.Net MVC?
body: <p>I've been researching this intensely for the past few days.  </p>
  
  <p>We're developing an ASP.Net MVC site that needs to support 100,000+ users.  We'd like to keep it fast, scalable, and simple.  We have our own SQL database tables for user and user_role, etc.  We are not using server controls.</p>
  
  <p>Given that there are no server controls, and a custom membershipProvider would need to be created, where is there any benefit left to use ASP.Net Auth/Membership?</p>
  
  <p>The other alternative would seem to be to create custom code to drop a UniqueID CustomerID in a cookie and authenticate with that.  Or, if we're paranoid about sniffers, we could encrypt the cookie as well.</p>
  
  <p>Is there any real benefit in this scenario (MVC and customer data is in our own tables) to using the ASP.Net auth/membership framework, or is the fully custom solution a viable route?</p>
  
  <p>Update:  I found one person (Matt Briggs) who seems to have come to some of the same conclusions I have:  This comes from this link:  <a href="http://webcache.googleusercontent.com/search?q=cache:Xm1-OrRCZXIJ:mattcode.net/posts/asp-net-membership-sucks+asp.net+membership+sucks&amp;hl=en&amp;gl=us&amp;strip=1" rel="nofollow noreferrer">http://webcache.googleusercontent.com/search?q=cache:Xm1-OrRCZXIJ:mattcode.net/posts/asp-net-membership-sucks+asp.net+membership+sucks&amp;hl=en&amp;gl=us&amp;strip=1</a> </p>
  
  <blockquote>
    <p>ASP.net membership is a poorly
    engineered API that is insecure out of
    the box, is not well maintained, and
    gives developers a false sense of
    security. Authentication is a weekend
    project if you aren't building a
    framework, but still, most .net
    developers blindly follow the official
    APIs, assuming that a major
    corporation like MS can put out
    something decent.</p>
  </blockquote>