ASP.NET user login best practices -

i want make login system using asp.net (mvc).

on internet, found bad examples involved sql in click events. other information pointed asp.net built-in membership provider.

however, want roll own. don't want use built-in membership provider, seems work on ms sql, , don't idea of having few foreign tables in database.

i think of something, need few pointers in right direction. not have high-security, regular common-sense security.

and have few direct questions:

1. a lot of systems seem have session id stored in user table. guess tie session user prevent hijacking. check every time user enters page? , do if session expires?

2. hashing, salting, do? know of md5 hashing , have used before. not salting.

3. best practices cookies?

i dont know best practices can tell do. not hitech security job.

i use forms authentication. receive password secured ssl via textbox on login page. take password , hash it. (hashing 1 way encryption, can hash code cant reversed password). take hash , compare users hash in database. if hash's match use asp.nets built in authentication handling, handles cookies me.

the formsauthentication class has methods available fo you, such setauthcookie , redirectfromlogin. set cookie , mark them authenticated. cookie asp.net uses encrypted. cant speak security level though, in common use.

in class password check , use formsauth handle rest:

if(securityhelper.loginuser(txtusername.text, txtpassword.text)) {         formsauthentication.redirectfromloginpage(txtusername.text, true); }