Solved

How to secure the logged-in web pages from direct url access in ASP.NET

Posted on 2008-10-30
7
352 Views
Last Modified: 2013-12-17
I AM DEVELOPING A WEBSITE.
THERE is a default page. default.aspx from which user logs in by forms authentication
 (NOT using built in Login controls of ASP.NET 2.0
Inner pages are  say userprofile.aspx, changepassword .aspx.

I  want when a user types www.mydomian.aspx/ userprofile.aspx    or    www.mydomian.aspx/ changepassword .aspx they should be redirected to login page i.e. www.mydomian.aspx/ default.aspx    for obvious security reasons.

Please tell me a well secured way to do this
Thanks
0
Comment
Question by:dhiraj79
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 53

Expert Comment

by:Dhaest
ID: 22840747
protected void Page_Load(object sender, EventArgs e)
 {
        if (Session["Member_Id"] != null)
        {
            if (!Page.IsPostBack)
            {
            }
        }
        else
        {
            Response.Redirect("Register.aspx");
        }
 }
0
 
LVL 53

Accepted Solution

by:
Dhaest earned 200 total points
ID: 22840750
If you are using forms authentication, you should use the below code in web.config file.

 <authorization>
<deny users="?"/>

<allow users="*"/>
</authorization>

Which will deny the anonymous users to enter and all all other users (authenticated).

In this case, automatically the request will be transfered to the login page you specified in the <forms> tag

0
 

Author Comment

by:dhiraj79
ID: 22842228
Thanks Dhaest for reply.
I have still a problem after applying your solution.

I have to set of pages:
Pages which should not need authentication :
home.aspx, register.aspx and forgotpassword.aspx.
Pages which need authentication :
usertype1Home.aspx,usertype2Home.aspx, etc

by applying the above code register.aspx and forgotpassword.aspx are also not accessible wtihout authentication whose link are from home.aspx.
This should not happen.

Th C# code I am using for redirecting to usertype1Home.aspx,usertype2Home.aspx, etc
is(After checking credentials in database)
FormsAuthentication.RedirectFromLoginPage(username,false);
Response.redirect("usertype1Home.aspx);

Web.config code:
<Authentication mode "forms">
<forms  login url = "Home.aspx">
</Authentication >
<Authorization>
<deny users="?"/>

<allow users="*"/>

</Authorization>


The only problem is I want forgotpassword and Register pages to be accessible form home page without authentication.
0
Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

 

Expert Comment

by:grogo21
ID: 22842352
I usually place the pages that require authentication in a separate directory.  I then place another web.cofig file in that directory with the following:

<configuration>
      <system.web>
                 <authorization>
                          <deny users="?" />
                  </authorization>
       </system.web>
</configuration>

This will require authentication for only the page contained in the directory.
0
 

Assisted Solution

by:grogo21
grogo21 earned 200 total points
ID: 22842388
Or, define each page which requires authentication in the web.config like so:

    <location path="MyPage.aspx">
        <system.web>
            <authorization>
                <deny users="?"/>
            </authorization>
        </system.web>
    </location>
    <location path="AnotherPage.aspx">
        <system.web>
            <authorization>
                <deny users="?"/>
            </authorization>
        </system.web>
    </location>
0
 
LVL 22

Assisted Solution

by:prairiedog
prairiedog earned 100 total points
ID: 22842434
Alternative way is to add <location> element in your current web.config like the attached code snippet.

<location path="home.aspx">
	<system.web>
		<authorization>
			<allow users="?" />
		</authorization>
	
	</system.web>
  </location>
 
<location path="register.aspx">
	<system.web>
		<authorization>
			<allow users="?" />
		</authorization>
	
	</system.web>
  </location>

Open in new window

0
 
LVL 22

Expert Comment

by:prairiedog
ID: 22842440
Bump, ignore my last post.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of us here at EE write code. Many of us write exceptional code; just as many of us write exception-prone code. As we all should know, exceptions are a mechanism for handling errors which are typically out of our control. From database errors, t…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question