Forms authentication on a business WAN

[Philbert]

L.S.,

For our client we have built a web application for use on their
internal network.
The employees need to log onto the application specifically,
regardless of their Windows authorisation status.

Web.config contains the following lines:

<authentication mode="Forms">
<forms name=".ASPXEFORM" loginUrl="ef_login.aspx" protection="All"
timeout="10" />
</authentication>

<authorization>
<deny users="?" />
</authorization>

What I find is that people that are logged into the network are not
considered anonymous and can access the application without passing
through ef_login.aspx

How can I prevent this?

Greetings,
Philbert de Zwart,
The Netherlands.

 

[Jim Cheshire [MSFT]]

Philbert,

As long as the user is requesting an .aspx page or another page mapped to
the aspnet_isapi.dll, this should work fine (although your web.config is
not configured as recommended.)

See this:
301240 HOW TO: Implement Forms-Based Authentication in Your ASP.NET
Application
http://support.microsoft.com/?id=301240

Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.


--------------------