Home Library Learn Downloads Support Community
Sign in | United States - English | |
0 out of 2 rated this helpful Rate this topic

FormsAuthentication Class

.NET Framework 4

Manages forms-authentication services for Web applications. This class cannot be inherited.

System.Object
  System.Web.Security.FormsAuthentication

Namespace:  System.Web.Security
Assembly:  System.Web (in System.Web.dll)
C#
C++
F#
VB
Copy 
public sealed class FormsAuthentication

The FormsAuthentication type exposes the following members.

  Name Description
Public method FormsAuthentication Initializes a new instance of the FormsAuthentication class.
Top
  Name Description
Public property Static member CookieDomain Gets the value of the domain of the forms-authentication cookie.
Public property Static member CookieMode Gets a value that indicates whether the application is configured for cookieless forms authentication.
Public property Static member CookiesSupported Gets a value that indicates whether the application is configured to support cookieless forms authentication.
Public property Static member DefaultUrl Gets the URL that the FormsAuthentication class will redirect to if no redirect URL is specified.
Public property Static member EnableCrossAppRedirects Gets a value indicating whether authenticated users can be redirected to URLs in other Web applications.
Public property Static member FormsCookieName Gets the name of the cookie used to store the forms-authentication ticket.
Public property Static member FormsCookiePath Gets the path for the forms-authentication cookie.
Public property Static member IsEnabled
Public property Static member LoginUrl Gets the URL for the login page that the FormsAuthentication class will redirect to.
Public property Static member RequireSSL Gets a value indicating whether the forms-authentication cookie requires SSL in order to be returned to the server.
Public property Static member SlidingExpiration Gets a value indicating whether sliding expiration is enabled.
Public property Static member TicketCompatibilityMode
Public property Static member Timeout
Top
  Name Description
Public method Static member Authenticate Validates a user name and password against credentials stored in the configuration file for an application.
Public method Static member Decrypt Creates a FormsAuthenticationTicket object based on the encrypted forms-authentication ticket passed to the method.
Public method Static member EnableFormsAuthentication
Public method Static member Encrypt Creates a string containing an encrypted forms-authentication ticket suitable for use in an HTTP cookie.
Public method Equals(Object) Determines whether the specified Object is equal to the current Object. (Inherited from Object.)
Protected method Finalize Allows an object to try to free resources and perform other cleanup operations before it is reclaimed by garbage collection. (Inherited from Object.)
Public method Static member GetAuthCookie(String, Boolean) Creates an authentication cookie for a given user name. This does not set the cookie as part of the outgoing response, so that an application can have more control over how the cookie is issued.
Public method Static member GetAuthCookie(String, Boolean, String) Creates an authentication cookie for a given user name. This does not set the cookie as part of the outgoing response.
Public method GetHashCode Serves as a hash function for a particular type. (Inherited from Object.)
Public method Static member GetRedirectUrl Returns the redirect URL for the original request that caused the redirect to the login page.
Public method GetType Gets the Type of the current instance. (Inherited from Object.)
Public method Static member HashPasswordForStoringInConfigFile Produces a hash password suitable for storing in a configuration file based on the specified password and hash algorithm.
Public method Static member Initialize Initializes the FormsAuthentication object based on the configuration settings for the application.
Protected method MemberwiseClone Creates a shallow copy of the current Object. (Inherited from Object.)
Public method Static member RedirectFromLoginPage(String, Boolean) Redirects an authenticated user back to the originally requested URL or the default URL.
Public method Static member RedirectFromLoginPage(String, Boolean, String) Redirects an authenticated user back to the originally requested URL or the default URL using the specified cookie path for the forms-authentication cookie.
Public method Static member RedirectToLoginPage Redirects the browser to the login URL.
Public method Static member RedirectToLoginPage(String) Redirects the browser to the login URL with the specified query string.
Public method Static member RenewTicketIfOld Conditionally updates the issue date and time and expiration date and time for a FormsAuthenticationTicket.
Public method Static member SetAuthCookie(String, Boolean) Creates an authentication ticket for the supplied user name and adds it to the cookies collection of the response, or to the URL if you are using cookieless authentication.
Public method Static member SetAuthCookie(String, Boolean, String) Creates an authentication ticket for the supplied user name and adds it to the cookies collection of the response, using the supplied cookie path, or using the URL if you are using cookieless authentication.
Public method Static member SignOut Removes the forms-authentication ticket from the browser.
Public method ToString Returns a string that represents the current object. (Inherited from Object.)
Top

Forms authentication enables user and password validation for Web applications that do not require Windows authentication. With forms authentication, user information is stored in an external data source, such as a Membership database, or in the configuration file for an application. Once a user is authenticated, forms authentication maintains an authentication ticket in a cookie or in the URL so that an authenticated user does not need to supply credentials with each request.

Forms authentication is enabled by setting the mode attribute of the authentication configuration element to Forms. You can require that all requests to an application contain a valid user authentication ticket by using the authorization configuration element to deny the request of any unknown user, as shown in the following example.

Copy 
<system.web>
  <authentication mode="Forms">
    <forms loginUrl="login.aspx" />
  </authentication>
  <authorization>
    <deny users="?" />
  </authorization>
</system.web>

In the previous example, any request for an ASP.NET page that is part of the application requires a valid user name that is supplied by forms authentication. If no user name exists, then the request is redirected to the configured LoginUrl.

The FormsAuthentication class provides access to methods and properties that you can use in an application that authenticates users. The RedirectToLoginPage method redirects a browser to the configured LoginUrl for users to log into an application. The RedirectFromLoginPage method redirects an authenticated user back to the original protected URL that was requested or to the DefaultUrl. There are also methods that enable you to manage forms-authentication tickets, if needed.

TopicLocation
How to: Implement Simple Forms AuthenticationBuilding ASP .NET Web Applications
How to: Use Advanced Features of the ASP.NET Login ControlBuilding ASP .NET Web Applications
How to: Create an ASP.NET Login PageBuilding ASP .NET Web Applications
How to: Implement Simple Forms AuthenticationBuilding ASP .NET Web Applications
How to: Use Advanced Features of the ASP.NET Login ControlBuilding ASP .NET Web Applications
How to: Create an ASP.NET Login PageBuilding ASP .NET Web Applications
Walkthrough: Creating a Web Site with Membership and User Login (Visual Studio)Building ASP .NET Web Applications in Visual Studio
How to: Create an ASP.NET Login PageBuilding ASP .NET Web Applications in Visual Studio

The following code example shows the Web.config file for an ASP.NET application that uses the ASP.NET membership provider for forms authentication and requires all users to be authenticated.

Copy 
<configuration>
  <connectionStrings>
    <add name="SqlServices" connectionString="Data Source=MySqlServer;Integrated Security=SSPI;Initial Catalog=aspnetdb;" />
  </connectionStrings>
  <system.web>
    <membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="20">
      <providers>
        <add name="SqlProvider"
          type="System.Web.Security.SqlMembershipProvider"
          connectionStringName="SqlServices"
          enablePasswordRetrieval="false"
          enablePasswordReset="true"
          requiresQuestionAndAnswer="true"
          passwordFormat="Hashed"
          applicationName="/" />
      </providers>
    </membership>
  </system.web>
</configuration>

The following code example shows the login page for an ASP.NET application that uses forms authentication and ASP.NET membership.

Security noteSecurity Note

This example contains a text box that accepts user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.

C#
VB
Copy 

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">

public void Login_OnClick(object sender, EventArgs args)
{
   if (Membership.ValidateUser(UsernameTextbox.Text, PasswordTextbox.Text))
      FormsAuthentication.RedirectFromLoginPage(UsernameTextbox.Text, NotPublicCheckBox.Checked);
   else
     Msg.Text = "Login failed. Please check your user name and password and try again.";
}


</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
  <title>Login</title>
</head>
<body>

<form id="form1" runat="server">
  <h3>Login</h3>

  <asp:Label id="Msg" ForeColor="maroon" runat="server" /><br />

  Username: <asp:Textbox id="UsernameTextbox" runat="server" /><br />
  Password: <asp:Textbox id="PasswordTextbox" runat="server" TextMode="Password" /><br />

  <asp:Button id="LoginButton" Text="Login" OnClick="Login_OnClick" runat="server" />
  <asp:CheckBox id="NotPublicCheckBox" runat="server" /> 
  Check here if this is <span style="text-decoration:underline">not</span> a public computer.

</form>

</body>
</html>

.NET Framework

Supported in: 4, 3.5, 3.0, 2.0, 1.1, 1.0
  • AspNetHostingPermission  

    To use the FormsAuthentication class in a hosted environment. Demand value: LinkDemand. Permission value: Minimal.

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows XP SP2 x64 Edition, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.
Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.
Did you find this helpful?
(2000 characters remaining)
Community Content Add
Annotations FAQ