In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in ASP.NET MVC for being vulnerable to trivial attacks:

The ASP.NET team doesn’t support using mixed-mode authentication in an application. If you search the web, you’ll find blog posts on how to do this, but please note that the techniques discussed in these blog posts are discouraged by the team. The reason this is discouraged is that it is very difficult to reason about security from a correctness point of view, and there are trivial attacks against such a setup that can allow malicious clients to masquerade as an authenticated user. If a supported/secure approach to using mixed-mode authentication is important to you, make a request on our UserVoice page. (source)

For context, this was a couple years before OWIN-MixedAuth came about. I don't know if this StackOverflow answer from January 2012 is representative of the kind of advice blogs were giving at the time, but it recommends mixing WebPages with MVC and placing a JavaScript redirect on IIS's 401 page.

It would be useful to know what attacks Microsoft is referring to in order to evaluate the security of current solutions like OWIN-MixedAuth.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.