---
title: "How do you enable Forms Authentication in Web.config?"  
description: "How do you enable Forms Authentication in Web.config?"  
author: "ICSM Computer"  
published: 2025-06-01  
updated: 2025-06-01  
canonical: https://www.mindstick.com/interview/34191/how-do-you-enable-forms-authentication-in-web-config  
category: "c#"  
tags: ["c#", "authentication"]  
reading_time: 2 minutes  

---

# How do you enable Forms Authentication in Web.config?

To enable **Forms Authentication** in your ASP.NET application's `web.config` file, you need to configure the `<authentication>` and `<authorization>` sections. Here’s how you do it:

### Basic Setup to Enable Forms Authentication

Add the following inside the `<system.web>` section of your `web.config`:

```xml
<system.web>
  <authentication mode="Forms">
    <forms loginUrl="~/Login.aspx" timeout="30" />
  </authentication>

  <authorization>
    <deny users="?" />
  </authorization>
</system.web>
```

### Explanation:

- `<authentication mode="Forms">`: This tells ASP.NET to use Forms Authentication.
- `<forms loginUrl="~/Login.aspx" timeout="30" />`:
- `loginUrl` specifies the path to the login page where unauthenticated users will be redirected.
- `timeout` sets the expiration time (in minutes) for the authentication ticket.
- `<authorization>` **section**:
- `<deny users="?" />` denies access to all anonymous (not logged in) users.
- This means only authenticated users can access the site or resources by default.

### Optional configurations you can add inside `<forms>`:

1. `name`: the name of the authentication cookie (default is `.ASPXAUTH`).
2. `path`: the cookie path (default is `/`).
3. `requireSSL="true"`: forces the cookie to be sent over HTTPS only.
4. `slidingExpiration="true"`: refreshes the cookie expiration time on each request.

## Answers

### Answer by ICSM Computer

To enable **Forms Authentication** in your ASP.NET application's `web.config` file, you need to configure the `<authentication>` and `<authorization>` sections. Here’s how you do it:

### Basic Setup to Enable Forms Authentication

Add the following inside the `<system.web>` section of your `web.config`:

```xml
<system.web>
  <authentication mode="Forms">
    <forms loginUrl="~/Login.aspx" timeout="30" />
  </authentication>

  <authorization>
    <deny users="?" />
  </authorization>
</system.web>
```

### Explanation:

- `<authentication mode="Forms">`: This tells ASP.NET to use Forms Authentication.
- `<forms loginUrl="~/Login.aspx" timeout="30" />`:
- `loginUrl` specifies the path to the login page where unauthenticated users will be redirected.
- `timeout` sets the expiration time (in minutes) for the authentication ticket.
- `<authorization>` **section**:
- `<deny users="?" />` denies access to all anonymous (not logged in) users.
- This means only authenticated users can access the site or resources by default.

### Optional configurations you can add inside `<forms>`:

1. `name`: the name of the authentication cookie (default is `.ASPXAUTH`).
2. `path`: the cookie path (default is `/`).
3. `requireSSL="true"`: forces the cookie to be sent over HTTPS only.
4. `slidingExpiration="true"`: refreshes the cookie expiration time on each request.


---

Original Source: https://www.mindstick.com/interview/34191/how-do-you-enable-forms-authentication-in-web-config

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.