Configuring Forms Authentication

The forms authentication setup process is done in the

<authentication> part of your

web.config file. As with all XML documents, the web.config file's contents are case

sensitive.

Here's the application's web.config file:

<configuration>

<system.web>

<authentication mode="Forms">

<forms name="CookBookForm"

loginUrl="login.aspx"

protection="All"

timeout="30"

path="/" />

</authentication>

</system.web>

</configuration>

Comments

The <forms> tag in web.config provides all the configuration necessary to provide forms

authentication for your application.

This tag includes the following options:

n name-This sets the name of the HTTP cookie that will be sent. If you have multiple

applications on the same server with forms authentication set up, you must

make this value unique in each one of them.

n loginUrl-This sets the location where the users are redirected for login (or any

other action) if they are not authenticated and try to access a secure page.

n protection-This specifies the level of protection to place on the cookie.You

can set this to All, None, Encryption or Validation, the default (and recommended)

is All.

n timeout-This sets the amount of time (in minutes) that a cookie remains valid,

after it was last requested, before it expires.

n path-This sets the path for the cookies to use; default is a backslash.This provides

additional protection because the client browser will not send the cookie if

there is a path mismatch.This value is case-sensitive to some browsers.