FormsAuthentication.Authenticate(String, String) Method

Reference

Definition

Namespace:: System.Web.Security

Assembly:: System.Web.dll

Important

Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

Caution

The recommended alternative is to use the Membership APIs, such as Membership.ValidateUser. For more information, see http://go.microsoft.com/fwlink/?LinkId=252463.

Validates a user name and password against credentials stored in the configuration file for an application.

public:
 static bool Authenticate(System::String ^ name, System::String ^ password);

public static bool Authenticate (string name, string password);

[System.Obsolete("The recommended alternative is to use the Membership APIs, such as Membership.ValidateUser. For more information, see http://go.microsoft.com/fwlink/?LinkId=252463.")]
public static bool Authenticate (string name, string password);

static member Authenticate : string * string -> bool

[<System.Obsolete("The recommended alternative is to use the Membership APIs, such as Membership.ValidateUser. For more information, see http://go.microsoft.com/fwlink/?LinkId=252463.")>]
static member Authenticate : string * string -> bool

Public Shared Function Authenticate (name As String, password As String) As Boolean

Parameters

name: String

The user name.

password: String

The password for the user.

Returns

Boolean

true if the user name and password are valid; otherwise, false.

Attributes: ObsoleteAttribute

Examples

The following code example shows user credentials stored in the Web.config file for an application. The password values have been hashed using the HashPasswordForStoringInConfigFile method.

This example uses SHA1. Due to collision problems with SHA1, Microsoft recommends SHA256.

<authentication mode="Forms">

<forms loginUrl="login.aspx">

<credentials passwordFormat="SHA1">

<user name="user1" password="27CE4CA7FBF00685AF2F617E3F5BBCAFF7B7403C" />

<user name="user2" password="D108F80936F78DFDD333141EBC985B0233A30C7A" />

<user name="user3" password="7BDB09781A3F23885CD43177C0508B375CB1B7E9"/>

</credentials>

</forms>

</authentication>

The following code example shows a login page that uses the Authenticate method to validate user credentials.

Important

This example contains a text box that accepts user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">

public void Login_OnClick(object sender, EventArgs args)
{
   if (FormsAuthentication.Authenticate(UsernameTextbox.Text, PasswordTextbox.Text))
      FormsAuthentication.RedirectFromLoginPage(UsernameTextbox.Text, NotPublicCheckBox.Checked);
   else
     Msg.Text = "Login failed. Please check your user name and password and try again.";
}


</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
  <title>Login</title>
</head>
<body>

<form id="form1" runat="server">
  <h3>Login</h3>

  <asp:Label id="Msg" ForeColor="maroon" runat="server" /><br />

  Username: <asp:Textbox id="UsernameTextbox" runat="server" /><br />
  Password: <asp:Textbox id="PasswordTextbox" runat="server" TextMode="Password" /><br />
 
  <asp:Button id="LoginButton" Text="Login" OnClick="Login_OnClick" runat="server" />
  <asp:CheckBox id="NotPublicCheckBox" runat="server" /> 
  Check here if this is <span style="text-decoration:underline">not</span> a public computer.

</form>

</body>
</html>

<%@ Page Language="VB" %>
<%@ Import Namespace="System.Web.Security" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">

Public Sub Login_OnClick(sender As Object, args As EventArgs)
   If FormsAuthentication.Authenticate(UsernameTextbox.Text, PasswordTextbox.Text) Then
      FormsAuthentication.RedirectFromLoginPage(UsernameTextbox.Text, NotPublicCheckBox.Checked)
   Else
     Msg.Text = "Login failed. Please check your user name and password and try again."
   End If
End Sub

</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
  <title>Login</title>
</head>
<body>

<form id="form1" runat="server">
  <h3>Login</h3>

  <asp:Label id="Msg" ForeColor="maroon" runat="server" /><br />

  Username: <asp:Textbox id="UsernameTextbox" runat="server" /><br />
  Password: <asp:Textbox id="PasswordTextbox" runat="server" TextMode="Password" /><br />
 
  <asp:Button id="LoginButton" Text="Login" OnClick="Login_OnClick" runat="server" />
  <asp:CheckBox id="NotPublicCheckBox" runat="server" /> 
  Check here if this is <span style="text-decoration:underline">not</span> a public computer.

</form>

</body>
</html>

Remarks

The Authenticate method verifies user credentials that are stored in the credentials section of the application configuration file. Alternatively, you can use ASP.NET membership to store user credentials and call the ValidateUser to verify the credentials. For more information, see Managing Users by Using Membership.

For improved security, you can encrypt passwords stored in the configuration file for an application by using the HashPasswordForStoringInConfigFile method.

Applies to

Jaa