Solved

How to secure the logged-in web pages from direct url access in ASP.NET

Posted on 2008-10-30
7
349 Views
Last Modified: 2013-12-17
I AM DEVELOPING A WEBSITE.
THERE is a default page. default.aspx from which user logs in by forms authentication
 (NOT using built in Login controls of ASP.NET 2.0
Inner pages are  say userprofile.aspx, changepassword .aspx.

I  want when a user types www.mydomian.aspx/ userprofile.aspx    or    www.mydomian.aspx/ changepassword .aspx they should be redirected to login page i.e. www.mydomian.aspx/ default.aspx    for obvious security reasons.

Please tell me a well secured way to do this
Thanks
0
Comment
Question by:dhiraj79
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 53

Expert Comment

by:Dhaest
ID: 22840747
protected void Page_Load(object sender, EventArgs e)
 {
        if (Session["Member_Id"] != null)
        {
            if (!Page.IsPostBack)
            {
            }
        }
        else
        {
            Response.Redirect("Register.aspx");
        }
 }
0
 
LVL 53

Accepted Solution

by:
Dhaest earned 200 total points
ID: 22840750
If you are using forms authentication, you should use the below code in web.config file.

 <authorization>
<deny users="?"/>

<allow users="*"/>
</authorization>

Which will deny the anonymous users to enter and all all other users (authenticated).

In this case, automatically the request will be transfered to the login page you specified in the <forms> tag

0
 

Author Comment

by:dhiraj79
ID: 22842228
Thanks Dhaest for reply.
I have still a problem after applying your solution.

I have to set of pages:
Pages which should not need authentication :
home.aspx, register.aspx and forgotpassword.aspx.
Pages which need authentication :
usertype1Home.aspx,usertype2Home.aspx, etc

by applying the above code register.aspx and forgotpassword.aspx are also not accessible wtihout authentication whose link are from home.aspx.
This should not happen.

Th C# code I am using for redirecting to usertype1Home.aspx,usertype2Home.aspx, etc
is(After checking credentials in database)
FormsAuthentication.RedirectFromLoginPage(username,false);
Response.redirect("usertype1Home.aspx);

Web.config code:
<Authentication mode "forms">
<forms  login url = "Home.aspx">
</Authentication >
<Authorization>
<deny users="?"/>

<allow users="*"/>

</Authorization>


The only problem is I want forgotpassword and Register pages to be accessible form home page without authentication.
0
Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

 

Expert Comment

by:grogo21
ID: 22842352
I usually place the pages that require authentication in a separate directory.  I then place another web.cofig file in that directory with the following:

<configuration>
      <system.web>
                 <authorization>
                          <deny users="?" />
                  </authorization>
       </system.web>
</configuration>

This will require authentication for only the page contained in the directory.
0
 

Assisted Solution

by:grogo21
grogo21 earned 200 total points
ID: 22842388
Or, define each page which requires authentication in the web.config like so:

    <location path="MyPage.aspx">
        <system.web>
            <authorization>
                <deny users="?"/>
            </authorization>
        </system.web>
    </location>
    <location path="AnotherPage.aspx">
        <system.web>
            <authorization>
                <deny users="?"/>
            </authorization>
        </system.web>
    </location>
0
 
LVL 22

Assisted Solution

by:prairiedog
prairiedog earned 100 total points
ID: 22842434
Alternative way is to add <location> element in your current web.config like the attached code snippet.

<location path="home.aspx">
	<system.web>
		<authorization>
			<allow users="?" />
		</authorization>
	
	</system.web>
  </location>
 
<location path="register.aspx">
	<system.web>
		<authorization>
			<allow users="?" />
		</authorization>
	
	</system.web>
  </location>

Open in new window

0
 
LVL 22

Expert Comment

by:prairiedog
ID: 22842440
Bump, ignore my last post.
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Just a quick little trick I learned recently.  Now that I'm using jQuery with abandon in my asp.net applications, I have grown tired of the following syntax:      (CODE) I suppose it just offends my sense of decency to put inline VBScript on a…
More often than not, we developers are confronted with a need: a need to make some kind of magic happen via code. Whether it is for a client, for the boss, or for our own personal projects, the need must be satisfied. Most of the time, the Framework…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question