ASP.NET in a Nutshell

Name

<forms>

Synopsis

<forms
   loginUrl=String
   name=String
   path=String
   protection="All|None|Encryption|Validation”
   timeout=Integer>
</forms>

Provides attributes and one child element (<credentials>) to configure ASP.NET to use forms-based authentication.

Scope

Machine, Application

Attributes

name

Specifies the name of the authentication cookie. If this attribute is omitted, the value defaults to .ASPXAUTH. When running multiple applications that use forms-based authentication on the same server, it’s usually a good idea to give each application its own authentication cookie name -- to minimize the risk of authenticated users from one application being treated as authenticated in others.

loginUrl

Specifies the redirect URL for users who do not have a valid authentication cookie. If a user with no authentication cookie requests a page in the application, they will be redirected to this URL to log in. The login page can then redirect the user back to the originally requested page. If this attribute is omitted, the value defaults to login.aspx.

protection

Specifies the type of protection used to prevent the authentication cookie from being modified during transit. Valid values are:

All

Cookies are both encrypted (using triple DES encryption, if available) and subjected to data validation. Data validation is performed based on the settings of the <machineKey> element. All is the default value and is the recommended setting for securing the authentication cookie.

Encryption

Cookies are only ...