Forms authentication enables user and password validation for Web applications that do not require Windows authentication. With forms authentication, user information is stored in an external data source, such as a System.Web.Security.Membership database, or in the configuration file for an application. Once a user is authenticated, forms authentication maintains an authentication ticket in a cookie or in the URL so that an authenticated user does not need to supply credentials with each request.

Forms authentication is enabled by setting the mode attribute of the authentication configuration element to Forms. You can require that all requests to an application contain a valid user authentication ticket by using the authorization configuration element to deny the request of any unknown user, as shown in the following example.

<system.web>
  <authentication mode="Forms">
    <forms loginUrl="login.aspx" />
  </authentication>
  <authorization>
    <deny users="?" />
  </authorization>
</system.web>

In the previous example, any request for an ASP.NET page that is part of the application requires a valid user name that is supplied by forms authentication. If no user name exists, then the request is redirected to the configured FormsAuthentication.LoginUrl.

The System.Web.Security.FormsAuthentication class provides access to methods and properties that you can use in an application that authenticates users. The erload:System.Web.Security.FormsAuthentication.RedirectToLoginPage method redirects a browser to the configured FormsAuthentication.LoginUrl for users to log into an application. The erload:System.Web.Security.FormsAuthentication.RedirectFromLoginPage method redirects an authenticated user back to the original protected URL that was requested or to the FormsAuthentication.DefaultUrl. There are also methods that enable you to manage forms-authentication tickets, if needed.