What are authentication modes in ASP.NET?

Authentication is used to identify user credentials and validate them against some established authority. This is essential for application security since it prevents malicious attackers from accessing potentially sensitive application resources.

ASP.NET implements authentication through authentication providers. These are code modules that contain the necessary code to authenticate a user's credentials. It supports the following authentication modes:

• Windows authentication

• Forms authentication

• Passport authentication

Syntax

To enable the authentication provider, add the following line of code to the Web.config file:

The mode is set to either Windows, Forms, Passport, or None. The default value is Windows while None prevents any authentication mode from being applied.

Windows authentication

Windows authentication is used with Microsoft Internet Information Services (IIS) authentication. It allows a user to be authenticated based on the Windows user account. It consists of three sub-modes:

• Basic windows authentication: The browser prompts users to enter their credentials and sends them to the IIS over HTTP. This is the least secure mode of authentication since the data is not encrypted.

• Digest windows authentication: This is more secure compared to the Basic mode as it encrypts all data using the MD5 hash algorithm.

• Integrated windows authentication: User credentials are not sent over the network. Instead, the Windows NT LAN Manager (NTLM) challenge is issued for authentication.

Forms authentication

Forms authentication is a mechanism whereby authentication takes place via an HTML form. The user submits their credentials, and the system issues a cookie upon authentication. Subsequent requests have the cookie in the headers, which are authenticated by the ASP.NET event handler.

Forms authentication is a suitable mode when the application runs over the internet, and so, support for most browsers and operating systems is required.

Passport authentication

Passport authentication utilizes Microsoft's centralized passport service to authenticate users. There are separate passport servers that carry out the authentication duties and an encrypted cookie is generated for users that have signed up with the passport authentication mechanism.