1. 1.NET Web Forms Security Issues © 2002 by Jerry Post

2. 2 Built-In Security Testing .NET makes it easy to handle user authentication  Best for most commercial websites: Forms authentication  For internal websites: variations of Windows (not displayed here) web.config Folder to be protected login.aspx Form name Database Code to compare name and password FormsAuthentication. RedirectFromLoginPage

3. 3 Forms Based Authentication  Create a form that gets a username and password.  Imports System.Web.Security  Write your own code that checks the name and password against the database.  Set the form to be called automatically in the web.config file  In the login form, if the login is successful, use:  FormsAuthentication.RedirectFromLoginPage(username, False)  Otherwise, fall through for redisplay of the login page, or  Response.Redirect(“newpage”)