Understanding Forms Authentication

Across the Web, many sites rely on forms authentication. In general, forms authentication uses cookies to pass a user’s authentication token to the web server to satisfy authentication requests. Using forms authentication, a user will log into the system over an encrypted connection. After the system authenticates the user, it will return a token the client program can use to authenticate the user on different pages throughout the site. If the user connects to a page (or a program requests a web service) for which the user has not yet been authorized, the server will reroute the request to a page (or service) the client can use to authenticate the user.

As the client program interacts with the site, the program will store the authentication token within a cookie. If the client doesn’t support cookies, forms authentication will fail. In Chapter 5, “Looking at Key Operations,” you learned how to support cookies within web services and client programs.