Hello all,

Wer'e developing an ASP.NET C# application, which will contain an authentication system that authenticates users in multiple levels (user, admin, super-admin, etc.).

Our idea is NOT to use the built in ASP.NET forms authentication feature. Our plan is to create a whole 'new' system for it- based on the Session object, and SQL database contains users' info such as username & password.

Is there any SERIOUS different between our idea to the Forms authentication feature?

What security risks do we take? How do we solve them?

Is this a good alternative for the forms authentication feature?

Thanks in advance !