Secure authentication and authorization

[ap]

Hello,

I am new to asp.net and try to lean as much as can. I read all about from
based authentication and cookie based authorization. In real world
application, web site, what is the best, security wise, way to do the
authorization? Also I would like to know how to enforce maximum logon time.
For example, 3 unsuccessful logon attempts should prohibit user from logon
with 30 min. If you know any good example, please post to url.

Thanks
ap