Implementing security in a site has the following aspects:

• Authentication : It is the process of validating someone to enter into your website or webpage by using its credentials.

  • Windows Authentication
  • Forms Authentication
  • Passport Authentication
  • Custom Authentication

• Authorization : It is the process of restricting a user to its specific role and rights.

• Confidentiality : It involves transfer of information through a secure channel.

• Integrity : It involves maintaining the originality of the data.

Forms-Based Authentication

<configuration>

<system.web>
   <authentication mode="Forms">
      <forms loginUrl ="login.aspx"/>
   </authentication>
   
   <authorization>
      <deny users="?"/>
   </authorization>
</system.web>
...
...
</configuration>

The code to provide authentication should be like:

protected bool authenticate(String uname, String pass)
{
   if(uname == "Tom")
   {
      if(pass == "tom123")
         return true;
   }
   
   if(uname == "Dick")
   {
      if(pass == "dick123")
         return true;
   }
   
   if(uname == "Harry")
   {
      if(pass == "har123")
         return true;
   }
   
   return false;
}

public void OnLogin(Object src, EventArgs e)
{
   if (authenticate(txtuser.Text, txtpwd.Text))
   {
      FormsAuthentication.RedirectFromLoginPage(txtuser.Text, chkrem.Checked);
   }
   else
   {
      Response.Write("Invalid user name or password");
   }
}

<configuration>
   <system.web>
      <authentication mode="Forms">
         <forms loginUrl ="signup.aspx" defaultUrl = Welcome.aspx />
      </authentication>
   </system.web>
</configuration>