Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication.

For Example if somebody hacked my computer and got the ticket so he is able to gain access to my account, the same for the session Id if somebody stole it, so I do not know how it is more secure.

I think that we can use some techniques to protect the cookie from being stolen like to bind the active session with a token which always send with the active session.

So please could any body explain me if it is really more secure to use Form Authentication rather than Session Authentication.


I am wondering why do not send the ticket it self in the HTTP request it self rather than storing it at the cookie, in this case it will play the role of the token and the identifier at the same time.

  • Are you comparing Forms auth to HTTP challenge authentication? Or are you using a NTLM ticket? Kerberos? – goodguys_activate Jun 4 '15 at 14:44
  • unfortunately I do not know what does 'NTLM' mean? – Mohamad Jun 4 '15 at 14:46
  • but actually I compare the Session Authentication to the Form Authentication which uses the tickets to identify the user rather than the session Id. – Mohamad Jun 4 '15 at 14:48
  • Windows computers can log into an ASP website using the domain username... transparently. This is done using an authentication method. A session is different from an authentication method. – goodguys_activate Jun 4 '15 at 14:48
  • 1
    I don't know what Session Auth is. Can you provide a link? – user2320464 Jun 4 '15 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.