Hi

Many a time we use the forms authentication in our application. When using the forms authentication we need to configure it in the web.config file. There are many attributes to the configuration, which are many a time not utilized properly. Here is a look at the attributes of the Forms Authentication.

[Note: remember Forms element is the sub element of the authentication element inside System.web element in the web.config]

cookieless -  we can store the forms authentication ticket either in a cookie or in a cookieless representation of the URL. The default value is UseDeviceProfile. This means that ASP.Net determines storage of ticket on the basis of pre-computed browser profile.

DefaultUrl – this is the default URL of the Application.The request is redirected to this URL after successful login. Remember this value is only used when there is no value for redirect URL.

Domain – As the name suggest this specifies the Domain property on the HttpCookie containing the authentication ticket. We can use this attribute to share the same cookie till we have a common portion of a DNS namespace(two subdomain can share the cookie).

EnableCrossAppRedirects – if we set this attribute to true the forms authentication module then can extract the ticket from either the query string or the forms post variables.

LoginUrl – This is the URL of the login page. Unauthenticated users are redirected to this URL.

Name – this property contains the name of the Http cookie to be used for the authentication purpose.

Path – Path to use for the issued cookie. The default value is "/"

Protection - Method used to protect cookie data. Valid values are All, None, Encryption, Validation

RequireSSL – If set to true, Forms Authentication sets the secure bit on the forms authentication cookie.

SlidingExpiration - If set to true, Forms Authentication will periodically update the time to live for the forms authentication ticket. This occurs regardless of whether or not the ticket is contained in a cookie, or in a cookieless format on the URL.

Timeout - Amount of time in integer minutes, after which the cookie expires. The default value is 30. The timeout attribute is a sliding value, expiring n minutes from the time the last request was received.

Also check out this post of mine on the forms authentication.

Hope this helps
Thanks
Vikram