Difference between FormsAuthentication Microst.Asp

Question

The default Project template of ASP.NET MVC comes with a class named Microst.AspNet.Identity.Owin.SignInManager. This class is used to authenticate users

I dont understand why should i use SignInManager instead of using simple FormsAuthentication in an ASP.NET MVC Project. What are the benefits of SignInManager?

Does it authenticate in a different way according to FormsAuthentication? Is it more secure then FormsAuthentication? What can i do else with SignInManager except authentication?

What is the relation between SignInManager and the code below? Does The SignInManager use the settings which are set below?

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/Account/Login"),
    Provider = new CookieAuthenticationProvider
    {
        // Enables the application to validate the security stamp when the user logs in.
        // This is a security feature which is used when you change a password or add an external login to your account.  
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(30),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
    }
}); 

Answer 1

Forms Authentication is the old version of the authentication framework for ASP.NET. One really solid reason against using Forms authentication, is that it is deprecated.

The default template for ASP.NET MVC in the latest version of Visual Studio has an implementation of ASP.NET Identity Framework, hence the use of SignInManager. I believe that one of the main advantages to using ASP.NET Identity this is that it is hostable as OWIN middleware, which means it has no reliance on System.Web and thus no reliance on your web application.

Answer 2

MembershipProvider came with FormsAuthentication in ASP.NET 2.

ASP.NET Identity came with SignInManager in ASP.NET 5.

ASP.NET Identity is a new version of MembershipProvider. It offers a lot more features than legacy MembershipProvider.

For example,

• Two-factor authentication
• Token-based authentication
• Easy-to-add custom properties compare to MembershipProvider
• Get instance of UserManager from the OWIN context

If you do not need all those features, you can stick with FormsAuthentication which can be used without MembershipProvider.