Securing asp.net web app with Form Authentication

Question

In ASP.NET web app, I have login.aspx. I force that every user access through Login.aspx, setting that on web.config:

<authentication mode="Forms">
<forms name="coockie_aut" loginUrl="login.aspx" protection="All" path="/" timeout="60" slidingExpiration="true"/>
</authentication>

My question is: Using form authentication and loginurl, would it prevent from trying to hack any web page without accessing first Login.aspx? Does it mean that allways allways there will be forced to access Login.aspx first?

just.another.programmer · Accepted Answer · 2012-08-02 20:18:24Z

0

That depends what you mean by "hack". Default Forms Authentication will redirect any request with no session authentication token to the login page. There are all kinds of session stealing, man-in-the-middle, brute-force, and other varieties of attacks that you may still be vulnerable to.

answered Aug 2, 2012 at 20:18

just.another.programmer

8,8438 gold badges55 silver badges93 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Securing asp.net web app with Form Authentication

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related