ASP.NET Security Tutorials

This ASP.NET Security tutorial explains how to deny anonymous users access as a step of Windows Authentication in ASP.NET.

When you want to deny access to all unauthenticated users you have to use the <authorization> element of the web.config file to add a new authorization rule, as follows:

<configuration>

<system.web>

<!– Other settings omitted. [...]

This ASP.NET Security tutorial explains how to configure ASP.NET as a step of Windows Authentication.

Once you have followed the approach described in the article How to configure IIS 7.x as a step of Windows Authentication in ASP.NET, the authentication process happens automatically. In case if you are using the Visual Studio test web server [...]

This ASP.NET Security tutorial explains how to configure IIS 7.x as a step of Windows Authentication in ASP.NET.

You can implement Windows authentication through a module in the HTTP modules pipeline in IIS 7.x environment. This pipeline is a mixture of native modules shipping with IIS and managed modules shipping with ASP.NET. The big advantages [...]

This ASP.NET Security tutorial explains how does Kerberos Authentication work in ASP.NET.

Kerberos 5, the most secure authentication protocol, is a well-known public standard created by the IETF (Internet Engineering Task Force), and it implements a ticket-based authentication protocol.  When is activating Integrated Windows authentication, Windows uses Kerberos automatically under the following circumstances:

- [...]

This ASP.NET Security tutorial explains how does NT LAN Manager Authentication work in ASP.NET.

NTLM authentication, as one of alternatives of Integrated Windows authentication, is integrated into the Windows operating system since it has built-in network support. NTLM authenticates clients through a challenge/response mechanism that is based on a threeway handshake between the [...]

This ASP.NET Security tutorial explains how does Integrated Windows Authentication work in ASP.NET.

Integrated Windows authentication performs authentication without requiring any client interaction and the most convenient authentication standard for WAN-based and LAN-based intranet applications. When IIS asks the client to authenticate itself, the browser sends a token that represents the Windows user [...]

This ASP.NET Security tutorial explains how does Digest Windows Authentication work in ASP.NET.

Digest authentication requires the user to provide account information using a login dialog box that is displayed by the browser (you can see this approach in the article:  How does Basic Windows Authentication work in ASP.NET). Digest authentication passes a hash of [...]