I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for a while, haven't we upgraded yet?). Keeping in mind tomorrow if i am extending my services on mobile and other devices how easy it would be to reuse same stuff?

If i have to use Forms authentication what are my options to implement it (is it only the default .net forms auth)?

Thanks, Raman

closed as off-topic by schroeder, Jens Erat, Xander, M'vy, Eric G Mar 18 '15 at 22:14

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Jens Erat, Xander, M'vy, Eric G
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is more of a .Net authentication library question than a general InfoSec question. – schroeder Mar 18 '15 at 17:33
  • craigslist style: (email addy). Yahoo style: yahoo.com/tech/… – Neil McGuigan Mar 18 '15 at 18:47

Authentication by forms is still the norm. However, you may want to consider allowing your users to take advantage of a single sign solution.

For instance:

  • OpenId
  • Try rolling your own SAML (a single sign on protocol) based solution.

Keep in mind that this just let's your user share their sign in with another service. At some point they will have to sign in with a form somehow.

Or in some cases, it may be appropriate to auth cryptographically via private keys and the like. For instance, Github offers an option to authenticate via a private key. If this appropriate for your set up, you will most likely already know.

I also urge you to consider the option of allowing two factor authentication. Again, this does not obviate the need for a form authentication, but will make your form log-in's much safer.

Not the answer you're looking for? Browse other questions tagged or ask your own question.