Hi Guys,
When i use windows authentication and i am outside of network i get promoted with userid and password dialog box. Does this userid and password travel in clear text over the wire using internet explorer?

Paul.

Well, almost. Apparently, you're using Basic Authentication. Passwords sent over basic authentication are Base64 encoded. This means they're not really sent in clear text, but it's easy for most people to decrypt the stuff you send.

If you want basic authentication to be safe, you'll need to enable SSL / TSL on your Web server.

Cheers,

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.
While typing this post, I was listening to: U.F.Orb by The Orb (Track 2 from the album: U.F.Orb) What's This?

Hi Imar,
Thanks for the reply. Actually the window for userid and password i am referring to is provided by default by internet browser. IIS is set up for Windows authentication and so is config file for ASP.NET (web.config). Basic authentication isnt used anywhere. So thats what i was wondering is if initially challange response fails between browser and IIS, i get prompted for a default windows login via browser. Is this information sent as plain text or does browser uses this information for creating some token for challange since initial challange response fails. Windows authentication states that userid and password are never sent in clear. so i was curious. Thanks

paul.

So are you using Forms authentication? I think in that case, the problem is even worse. The information *will* be sent in clear text (not sure if any encoding takes place). Anyone sniffing the network with some widely available tools can see your credentials fly by.

Or do you get a true dialog? If that is the case, you *are* using basic authentication. Windows authentication in Web.config refers to where and how IIS validates the user, not the way the user is asked for credentials. So, if IIS is setup for Windows *and* basic authentication, setting the security to Windows in the Web.Config, can still result in Basic Authentication used when your site is accessed with a browser that doesn't understand Windows / Integrated security or cannot use it (when you're accessing the site over the Internet, for example.

The docs say this about mode="windows":
I can't believe that you get a password prompt if IIS is not set up for basic authentication.....
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.
While typing this post, I was listening to: I'm Hiding by KoRn (Track 13 from the album: Untouchables) What's This?

I think you clarified what i was after. Thanks for this feedback. :)

Great. You're welcome.

Out of curiosity, were you using Basic Authentication?

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.
While typing this post, I was listening to: Spanish Castles In Space by The Orb (Track 5 from the album: The Orb's Adventures Beyond The Ultraworld - Disc 1) What's This?

You got it imar..thanks again