Take the tour ×  I'm considering using FormsAuthentication in my
web app. Just how secure is it to specify the users in the
web.config that are allowed to use the application?  Here is an
example of what I am talking about:  <authentication
mode="Forms">       <forms loginUrl="TestLogin.aspx"
slidingExpiration="true" timeout="30">           <user
name="test" password="password"></user> share|improve this
question add comment  2 Answers  up vote 1 down vote accepted
By default, IIS will not serve any file that ends in a .config
extension, so as long as you trust anyone who has access to
manage your web server, you should be fine.  Think of it this
way: most people store database connection information in their
web.config files already, so if you have your users defined in a
database, it's just one step away from being compromised anyway.
If you've only got a few users to deal with, and their
credentials don't change often, you should be fine using
web.config to store your users. It's probably a good idea to