What is Forms Authentication Cookies:
Forms authentication cookie is the container for forms authentication ticket. The ticket is passed as the value of the forms authentication cookie with each request and is used by forms authentication, on the server, to identify an authenticated user.
IIS Authentication:
ASP.NET authentication is a two-step process. First, Internet Information Services (IIS) authenticates the user and creates a Windows token to represent the user. IIS determines the authentication mode that it should use for a particular application by looking at IIS metabase settings. If IIS is configured to use anonymous authentication, a token for the IUSR_MACHINE account is generated and used to represent the anonymous user. IIS-then passes the token to ASP.NET.
Second, ASP.NET performs its own authentication. The authentication method used is specified by the mode attribute of the authentication element. The following authentication configuration specifies that ASP.NET uses the FormsAuthenticationModule class.
Example:
The following example shows how to create a custom FormsAuthenticationTicket.
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, //The version number of the ticket.
username, //The user name associated with the ticket.
DateTime.Now, //The local date and time at which the ticket was issued.
DateTime.Now.AddMinutes(30), //The local date and time at which the ticket expires.
isPersistent, //true if the ticket will be stored in a persistent cookie (saved across browser sessions); otherwise, false. If the ticket is stored in the URL, this value is ignored.
userData, //The user-specific data to be stored with the ticket.
FormsAuthentication.FormsCookiePath //The path for the ticket when stored in a cookie.
);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
// Create the cookie.
Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
ASP.NET Forms Authentication:
ASP.NET forms authentication occurs after IIS authentication is completed. You can configure forms authentication with the forms element.
<authentication mode="Forms">
<forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH">
</forms>
</authentication>
Authorization Configuration:
In IIS, anonymous access is enabled for all applications that use forms authentication. The UrlAuthorizationModule class is used to help ensure that only authenticated users can access a page.
<authorization>
<deny users="?"/>
</authorization>
Web Farm Scenarios:
In a Web farm, you cannot guarantee which server will handle successive requests. If a user is authenticated on one server and the next request goes to another server, the authentication ticket will fail the validation and require the user to re-authenticate.
The validationKey and decryptionKey attributes in the machineKey element are used for hashing and encryption of the forms authentication ticket. The default value for these attributes is AutoGenerate.IsolateApps. The keys are auto-generated for each application, and they are different on each server. Therefore, authentication tickets that are encrypted on one computer cannot be decrypted and verified on another computer in a Web farm, or in another application on the same Web server.
Reference:
http://msdn.microsoft.com/en-us/library/aa480476.aspx
http://msdn.microsoft.com/en-us/library/system.web.security.formsauthenticationticket.aspx
http://support.microsoft.com/kb/910443