Forms Authentication In ASP.NET

Introduction

Form authentication is used for internet web application. The advantage of form authentication is that users do not have to be member of a domain-based network to have access to your application. So the number of web application uses the form authentication in their web application.

There are three types of authentication in ASP.NET,

Windows authentication
Forms authentication
Passport Authentication

Here I am going to explain only implementation of Forms Authentication.

These are the followings steps to use forms authentication in our web application.

Step 1: Open Visual Studio then go to the File Menu where we click New, then Project and select the ASP.NET web application and assign the name of the application in pop up menu.

open Apps

Step 2: After selecting the web application select an empty template here.

Step 3: In our web application here we add two pages one login.aspx and another welcome.aspx.

Here we added two web form login.aspx and welcome.aspx.

Step 4: Now we set web.config file to implement the authentication of web application.

<configuration>
<appSettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="None" />
</appSettings>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<authentication mode="Forms">
<forms loginUrl="login.aspx" defaultUrl="welcome.aspx">
<credentials passwordFormat="Clear">
<user name="abhishek" password="abhi@123"/>
<user name="Kantesh" password="sinha@123" />
</credentials>
</forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
<httpRuntime targetFramework="4.5" />
</system.web>
</configuration>

Here we add Forms authentication mode and loginUrl is my login page where we create our login form and we also assign two users for authentication which is hard coded. So only two users by this name can authenticate our application page. If any other users try to access our web application then it will deny the users that are defined under the authorization tag.

Steps 5: Now we create a login form in login.aspx page. For that we will write the code for login form here,

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Login.aspx.cs" Inherits="FormAuth.Login" %>
<!DOCTYPE html>
<html
xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
<h3>
Login Page</h3>
<table>
<tr>
<td>
UserName:</td>
<td>
<asp:TextBox ID="UserName" runat="server" />
</td>
<td>
<asp:RequiredFieldValidator ID="RequiredFieldValidator1"
ControlToValidate="UserName"
Display="Dynamic"
ErrorMessage="Cannot be empty."
runat="server" />
</td>
</tr>
<tr>
<td>
Password:</td>
<td>
<asp:TextBox ID="UserPass" TextMode="Password"
runat="server" />
</td>
<td>
<asp:RequiredFieldValidator ID="RequiredFieldValidator2"
ControlToValidate="UserPass"
ErrorMessage="Cannot be empty."
runat="server" />
</td>
</tr>
<tr>
<td>
Remember me?</td>
<td>
<asp:CheckBox ID="chkboxPersist" runat="server" />
</td>
</tr>
</table>
<asp:Button ID="Submit1" OnClick="Login_Click" Text="Log In"
runat="server" />
<p>
<asp:Label ID="Msg" ForeColor="red" runat="server" />
</p>
</form>
</body>
</html>

Step 6: Here we write the code for Login button in login.aspx.cs page.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.Security;
namespace FormAuth {
public partial class Login: System.Web.UI.Page {
protected void Page_Load(object sender, EventArgs e) {
}
protected void Login_Click(object sender, EventArgs e) {
if (FormsAuthentication.Authenticate(UserName.Text, UserPass.Text)) {
FormsAuthentication.RedirectFromLoginPage(UserName.Text, chkboxPersist.Checked);
} else {
Msg.Text = "Invalid User Name and/or Password";
}
}
}
}

Before writing the login button code user can directly redirect to the welcome page. If user type the Welcome page URL in browser, we need to prevent the direct access to the welcome page. For that we write the condition for authenticating the users on button click.

FormsAuthentication.Authenticate which takes two parameter username and password which authenticate the user and redirect the page after successful login.

Step 7: After writing the code of these pages now we are ready to execute the web application. To run the application we click Ctrl+F5 . After debugging the application our login page open in the browser.

Here we enter the valid Username and Password which we assigned in our web.config file. If we enter any invalid user then it will throw an exception.

Step 8: By entering the valid username and password our application will successfully authenticate the user which will redirect to the next welcome page after successfully login.

Here we checked the Remember me check box which means let's say you logged in and close the browser. You again open the browser with welcome page then you can access the authorized page without login. That means our browser cookies are enabled which store the user data in text file until the browser is cleared.

Finally, valid user successfully logged in our web application using Forms Authentication in ASP.NET.

8 Comments

Join the conversation! Your thoughts help the community grow.

vijay prakash7y ago
The request filtering module is configured to deny a request where the query string is too long.
Ava Ava7y ago
Sir, how can i redirect to a custom page instead of default page if its an existing user and to default page if its admin using forms authentication but not using roles ? Please reply asap, thanks!
- Raman Pundir7y ago
  Response.Redirect("destinationpage.aspx");
Muhammad Aqib Shehzad11y ago
nice one
Raja T11y ago
Nice, Thanks for sharing
Vignesh Mani11y ago
Nice one
Humayun Kabir Mamun11y ago
Nice...
Gowtham K11y ago
Good One, Thanks for sharing