Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

ASP.NET Master Pages prevent unauthorised page access

Posted on 2011-02-24
11
Medium Priority
?
721 Views
Last Modified: 2012-05-11
I have an ASP.NET project using a master page. I am not using much behind code but prefer to comm with the server using jQuery and ajax, so I'm calling child pages using window.location.href in JavaScript, which works fine.

I'm looking to a way to prevent someone accessing a child page by it's URL directly through their browser. Given how I've set things up as above, please recommend a good solution, preferably one that doesn't make use of the URL.

Thanks.
0
Comment
Question by:jonatec
  • 4
  • 2
  • 2
  • +1
11 Comments
 
LVL 13

Expert Comment

by:Rahul Agarwal
ID: 34969203
Try this:

function ShowRolePermission(Role_Id)
        {
        var hidFlag= document.getElementById('<%=hidFlag.ClientID %>');
       
         if (hidFlag.value=="")
         {
         
         var windowUrl = "Page.aspx?RoleId="+Role_Id;
          window.location = windowUrl;
         }
        }
0
 
LVL 20

Expert Comment

by:Proculopsis
ID: 34969210

You need to obfuscate the url and pass this information to another aspx which will validate the information and redirect:

  nextPage.aspx?key=67456FE456BC65454DD6465ABA564674485D876565FFBC444444AAA76456875CD

where key contains encrypted information on the page to redirect to and a time span, so the url cannot be bookmarked.
0
 

Author Comment

by:jonatec
ID: 34969698
Proculopsis:

I like the encryption possibility. Please help me understand further please:
You mention a "time span", do you mean encrypt a datetime and pass that?

Also, what is to stop the user copy/paste the whole url, together with encrypted parameter into another browser window ?
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 
LVL 20

Accepted Solution

by:
Proculopsis earned 1500 total points
ID: 34969742

>>>Also, what is to stop the user copy/paste the whole url, together with encrypted parameter into another browser window ?

Nothing, that's why you need to encode a time span for which the url is still valid.
0
 

Author Comment

by:jonatec
ID: 34969761
So you mean if the current time in the child page is > passed date/time + (say 60 seconds) then reject ?
0
 
LVL 16

Expert Comment

by:Kamal Khaleefa
ID: 35119825
@jonatec

i recomet to use like a session in your master page
for exaplme if the link is coming from the master page set your session to some value
and in the child page check the session value
if it is equal to what you set then it means it come from master page
otherwise
redirect him to the master page
0
 

Author Comment

by:jonatec
ID: 35122385
king2002

I want to use JavaScript window.location.href = "nextpage.aspx" to call the next page, then, for example, in nextpage.aspx use jQuery or JavaScript to check for direct page access. So perhaps the solution Proculopsis gave would be better suited as I would then have to craft or find an encryption algorithm written in JavaScript.
0
 
LVL 16

Expert Comment

by:Kamal Khaleefa
ID: 35125434
THEN TRY TO USE QUERY STRING WITH ENCRYPTION
0
 

Author Closing Comment

by:jonatec
ID: 35126582
I can't believe that it's such a big deal to prevent direct access to a web page through a saved URL. Anyway based on the lack on alternative answers from this forum I have to concede that if I want to control this through JavaScript then an encrypted URL with a timestamp wil do. Thanks.
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A while back, I ran into a situation where I was trying to use the calculated columns feature in SharePoint 2013 to do some simple math using values in two lists. Between certain data types not being accessible, and also with trying to make a one to…
CTAs encourage people to do something specific to show interest in your company, product or service. Keep reading to learn why CTAs should always be thought of as extremely important, albeit small, sections of websites.
Viewers will get an overview of the benefits and risks of using Bitcoin to accept payments. What Bitcoin is: Legality: Risks: Benefits: Which businesses are best suited?: Other things you should know: How to get started:
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
Suggested Courses

927 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question