We send the password salted as well as a challenge for logging into our Silverlight app.

I have worked at that company as well. I started using source control and they could not understand how multiple people can work one project at the same time.

WinMerge Subversion Dropbox iTunes to drown out distractions Digsby ReSharper

If I am following what youa re saying correctly you have a layout like login.aspx and then safe.aspx which requires authentication. Inside visual studio create a subfolder inside your solution and drag your safe.aspx page into there and right click on the folder click new then and add a web.config. Then add the security section I mentioned earlier. For your session timeout you can set that in your main web.config or on your page load event and that page is only called once.

Inside that subfolder you can create a new web.config then for authorization set it to This way it denies all anonymous users and will redirect them back to your main page.