forms-authentication

Are there any major advantages of using OWIN cookie-based authentication over Forms Authentication cookie-based authentication for developing MVC web applications? The reason I ask is that I would not be using any of the Entity Framework based hooks for OWIN authentication. I've built apps based on Forms Authentication for years and have been able to do things like create different authentication tokens for admins (faster timeouts), anonymous users, and registered users. Using the UserData portion of the ticket I was able to implement universal sign out, store custom properties, etc. One of

(See question below for more context): Are there any situations in which <machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps"/> in web.config would fail to AutoGenerate a new machineKey on App Pool recycle? This is the behavior I'm seeing... I'm using standard ASP.NET FormsAuthentication in an MVC app. If I log a user in using FormsAuthentication.GetAuthCookie and don't use a persistent cookie (relying on the browser's session to remember my authorized state), I would expect recycling the IIS App Pool to invalidate the session's knowledge of this cookie

I have written a custom AuthorizeAttribute which has the following condition in asp.net mvc3 application: public override void OnAuthorization(AuthorizationContext filterContext) { //auth failed, redirect to Sign In if (!filterContext.HttpContext.User.Identity.IsAuthenticated) { filterContext.Result = new HttpUnauthorizedResult(); } } And in my web.config, i have: <authentication mode="Forms"> <forms loginUrl="~/User/SignIn" timeout="2880" /> </authentication> On authentication fail, it redirects to "/Account/Login" page by default. How do i change this default redirect url and redirect it to

I am trying to implement a very basic Asp.net forms authentication mechanism for a MVC site. The problem I am getting is that my authentication cookie is being set to expire after one year whereas I don't want it to expire after such a long time. Here is some of my code: web.config <authentication mode="Forms"> <forms loginUrl="~/Account/Login" timeout="2" /> </authentication> controller ... FormsAuthentication.SetAuthCookie(username, false); ... I have found this answer (this question is similar but in my case timeout never occurs) but is this the only way to make the cookie expire or am I