• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 185
  • Last Modified:

Easy 500 - ASP.NET Closing Sessions

I'm was currently working on a secure adminstration area for a website. The user will login and their details are validated/authenicated by means of an access database. A session is created. What would be the best to stop people from directly accessing the secure pages behind the login.

What i'd like is to response.redirect the user back to the login.aspx if no valid session etc exists. Also when the browser is closed i'd like the session/authenication to end... very similiar to how the login part of experts exchange works.

Any help or advice appreciated!
0
Cloud9_User
Asked:
Cloud9_User
3 Solutions
 
SystemExpertCommented:
Hi,

You should use role based authentication. see the following link

http://www.codeproject.com/aspnet/rolesbasedauthentication.asp

Thanks
0
 
Cloud9_UserAuthor Commented:
Just to add... i'm currently using the Application_beginRequest to check whether the user session is valid but have once logged the sessions never seem to end.

0
 
DBAduck - Ben MillerPrincipal ConsultantCommented:
When you use Forms authentication, then ASP.NET handles the redirects and protects the folder from access without logging in.

Then you can couple that with role based authentication and allow multiple users in a role to get to the pages, or whatever your requirement is.

Ben.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
GENTPCommented:
I'd just put a yes/no field in the database, and call it Admin. When you validate a user, make sure to find out if they are an admin or not, and set Session["admin"]=true.

Then in the onload event of the admin page, simply do:

if(!Convert.ToBoolean(Session["admin"].ToString()))
    Response.Redirect("nonadminpage.aspx");
0
 
Cloud9_UserAuthor Commented:
Handling the session isn't too much of a problem, getting the session to close is though. i know it timeouts after a set period i.e 20 minutes by default but i'd like to have it closed when the browser closes.

Does any know how the likes of experts exchange and googles gmail do it?
0
 
GENTPCommented:
Have you tried:
Session.Abandon();

Or maybe even having an unload event that does something like (but it creates the problem of having to know what page someone is leaving the site from, not a very good solution):
Session.Timeout=1;//timeouts must be greater than 0, so you won't be able to do that :P
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now