<authentication mode="Forms" >
<forms loginUrl="login.aspx" name=".COOKIEDEMO" timeout="60" path="/" >
<credentials passwordFormat="SHA1">
<user name="user1"
password=" 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"/>
<user name="user2"
password=" 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"/>
</credentials>
</forms>
</authentication>
<authorization>
<deny users="?" />
</authorization>

This section specifies the use of forms authentication and provides the passwords for the users using format "SHA1". In this example the password for both the users is set to "password". The trick in deriving the encoded value of password is making use of the function:

FormsAuthentication.HashPasswordForStoringInConfigFile.

We have also indicated in the <authorization> section that anonymous users must be denied access to all files in this application. 

Replace the existing section for the SessionState with the following.

<sessionState cookieless="true"/>

Step 5: Build and Run the program and see the results.

When you initially request for the mobile web page belonging to this application, you are not authenticated and hence, directed to the login page.

Figure 2: In the initial request, the user is not authenticated and therefore, directed to the Login Web page.

Enter the following credentials:

Login: user1
Password: password

Note that the password text is not displayed to the user.  

Click on the Login button and you will be sent to the requested web site if the correct credentials are entered. 

Figure 3: User is authenticated successfully and redirected to the requested page.

After this the user will have access to the other web pages in the web site and won't be prompted for login unless the Logout button is clicked or the validity of the login expires. 

If the user clicks on the Logout button, he/she is logged out and redirected to the login page. 

Figure 4: Incorrect Credentials-Note the error message.

Conclusion:

Security is a major concern for all applications, especially for Mobile Web Applications. We saw the use of FormsAuthentication in this example. Forms Authentication does not depend on IIS. You can build on this simple example and fortify your web site against invalid access.