An Overview of Authentication and Authorization Options in ASP.NET
Security 101: Authentication and Authorization Authentication and Authorization are two interrelated security concepts. In short, authentication is a process of identifying a user, while authorization is the process of determining if an authenticated user has access to the resource(s) they requested. Typically, authentication is achieved by the user sharing credentials that somehow verify the user's identity. Whenever a user logs on to an application, the user is first authenticated and then authorized. With ASP.NET Web applications, the users requesting a page are, by default, anonymous . There are different techniques available for determining the identity of an anonymous user, which we'll examine in this article. Realize, however, that, by default, Web applications allow for anonymous access. This article provides a high-level overview of the authentication and authorization models available in an ASP.NET Web application. Understanding how ASP.NET and IIS Handl...