We have a web application being reviewed and I see the usual section in Web.Config:

<authentication mode="Windows">
  <forms loginUrl="~/Account/Login" timeout="10800" defaultUrl="~/"/>

The discussion here is whether this is inherently more secure than Forms authentication. One side of the argument is that Windows is fine as the user needs to have a Windows account to use the system.

My argument is "Sure, that's true but it doesn't mitigate every attack vector" and only provides the appearance of security.

Compounding this problem is the membership provider referencing a non-existing database connection and poor error handling, but this is a secondary problem.

What's the best argument to put forward around Windows Auth being treated as the panacea for web application security issues?

  • 1
    I would say, it depends. For an intranet application, I would tend towars the Windows authenticaton, because you save the forms user management, which comes with it's own risks. But for a more public website, I would go with the Forms authentication, to keep the Windows User Management (Active Directory) clean of web-related users. What kind of Website do you have?
    – Marcel
    Jul 4, 2016 at 6:05

1 Answer 1


In my experience, the biggest problem is that Windows authentication tends to conflate authentication and authorization. Just because a user has a Windows account does not mean they should be able to access a resource!

A simple example would be machine accounts. In an Active Directory system, machine accounts get Kerberos tokens just like users do. Most implementations of Windows auth I've seen trust that just because a user can be positively identified (authenticated) they are also authorized to access the protected resource, so any machine account will be able to access the protected resource.

  • (The best, solution, IMHO, is to throw ASP.NET under the biggest bus you can find. Of course, that may not be practical, but you should at least move to OWIN/Katana for auth.) Jul 4, 2016 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .