We have a web application being reviewed and I see the usual section in
<authentication mode="Windows"> <forms loginUrl="~/Account/Login" timeout="10800" defaultUrl="~/"/> </authentication>
The discussion here is whether this is inherently more secure than Forms authentication. One side of the argument is that Windows is fine as the user needs to have a Windows account to use the system.
My argument is "Sure, that's true but it doesn't mitigate every attack vector" and only provides the appearance of security.
Compounding this problem is the membership provider referencing a non-existing database connection and poor error handling, but this is a secondary problem.
What's the best argument to put forward around Windows Auth being treated as the panacea for web application security issues?