Authentication Pros & Cons (Forms vs Windows)

[GeeWond3r]

I'm going back and forth as to which kind of authentication method to go by. Can you guys give me some real world examples or conceptuals on the pros and cons of Forms -vs- Windows Authentication. There's been issues that Windows mode via Active Directory is the better one since it AD logs everything, plus has a better security protection. Then there's the Form mode via SQL Server.

Enquiring Minds wants to know...

Thanx!

 

[dragonwell]

It's usually a pretty clear-cut decision - if you're building a private/intranet-type application where all the users will be members of a specific domain then Windows is the way to go. On the other hand, for a public internet site where you will have many different users using different browsers and operating systems, use Forms.



Greetings,
Dragonwell

 

[MikeMCSD]

The only problem with Forms Authentication, using it
on the Internet, is that cookies must be enabled on
the client browser. I'm building a Web Store and this
might cost me some customers.

I'm working on a solution where I can check to see
if cookies are enabled (write a cookie then read it,
checking for empty string) and then using Session
state for the cookieless browsers.

 

[m0nty005]

dragon: my application is a time reporting system which is open to contractors outside my company. So I guess Forms authentication is the way to go. However, my netwrk admin is still persistent on using Windows mode since all logs are recorded + the security is much better.

Mike: couldn't I simply use the session state thru out w/o using cookies?

 

[MikeMCSD]

To tell you the truth, I'm still a little confused about
Forms Authentication and cookies and Session State.
But I know that by default, Session State uses cookies.
You have to go into Web.config and change it to "true":

<sessionState cookieless="false" />

then I believe the SessionID is handled through
Query String parameters that are passed back and
forth from client and server.

I haven't had time to analyze this article, but this
person says you can use Forms Auth. without cookies:

http://www.codeproject.com/aspnet/cookieless.asp

I still have to investigate this problem some more.

 

[dragonwell]

A common source of confusion is between FormsAuthentication's use of cookies and Session cookies. The two are not related! Even with <sessionState cookieless="false" />, FormsAuthentication will still use a cookie to hold the authentication ticket.

If your network admin wants the task of maintaining all the user accounts, go ahead and use Windows authentication.

Greetings,
Dragonwell