title: FormsAuthentication: Is it secure?
body: <p>Using <strong>FormsAuthentication</strong> build into <strong>asp.net</strong> it's very quick and easy to create a login system that creates a cookie for authenticated users:</p>
  
  <pre><code>FormsAuthentication.SetAuthCookie(uniqueUsername, false);
  </code></pre>
  
  <p>Paired with some code in the <strong>Web.Config</strong> file:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="Login.aspx" timeout="30" defaultUrl="Dashboard.aspx" protection="All" /&gt;
  &lt;/authentication&gt;
  &lt;authorization&gt;
    &lt;deny users="?" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>This will bounce all requests back to <strong>Login.aspx</strong> until the user is approved and a cookie is created using the SetAuthCookie() method call.</p>
  
  <p><strong>Is this secure enough?</strong><br>
  The rule of thumb I use is that I don't store any data on the client that they've not sent me. So what I've done in the past is hold the username and password used in a cookie, then re-authentic this with every request.</p>
  
  <p>There's the extra overhead of re-authenticating everytime with this approach, but it also means I've not storing any server data on the client.</p>
  
  <p><strong>My worry</strong><br>
  My concern is that by using the SetAuthCookie() method call, that the username is being stored on the client machine. Is it then possible for someone to break the encryption being used and substitute the username being stored for another?</p>
  
  <p>I think I'm being overly paranoid and that the type and level of encryption being used is adequate, but thought I'd get some expert input on the topic.</p>