asked on

password protection with web.config

I have set up password protection for my entire site using web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <connectionStrings>
    <add name="ApplicationServices" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient" />
  </connectionStrings>
  <system.web>
    <authentication mode="Forms">
      <forms name="testing" loginUrl="~/Account/Login.aspx" protection="All" timeout="30" path="/">
        <credentials passwordFormat="Clear">
          <user name="user" password="password"/>
        </credentials>
      </forms>
    </authentication>
    <authorization>
      <deny users="?"/>
    </authorization>
    
    <compilation targetFramework="4.0" />
    <pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID" />
  </system.web>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
        <defaultDocument>
            <files>
                <clear />
                <add value="default.aspx" />
                <add value="Default.htm" />
                <add value="Default.asp" />
                <add value="index.htm" />
                <add value="index.html" />
                <add value="iisstart.htm" />
            </files>
        </defaultDocument>
  </system.webServer>
</configuration>

Open in new window

Here is my cs file fro the login page

public partial class login : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {

    }
    protected void Button1_Click(object sender, EventArgs e)
    {
        if (FormsAuthentication.Authenticate(UserName.Value,
                                             UserPass.Value))
        {
            FormsAuthentication.RedirectFromLoginPage(UserName.Value, true);
        }
        else
        {
            Msg.Text = "Invalid Credentials: Please try again";
        }
    }
}

Open in new window

This works if I type in the domain name plus a page name, but if i type in only the domain name itself, the redirect aspect of the url for the login page has no page in the url query string, so redirectfromloginpage method has no page argument that it can get from the url and instead it keeps coming back to the login page, even after a successful login.

So how do i solve this problem?

Kumaraswamy R

Encrypting and Decrypting web.config

http://www.dotnetfunda.com/forums/thread9663-encrypt-only-connection-string-password-in-webconfig.aspx

madgino

You have a number of options:
- add default.aspx to project which will be loaded if you use only domain name
- add defaultUrl value in webconfig / authentication section / forms tag
- check for page argument using GetRedirectUrl and use SetAuthCookie instead RedirectFromLoginPage

Arnold Layne

ASKER

rkworlds, that is a good answer but it wasn't really relevant to my question as far as I can tell.

Arnold Layne

ASKER

madgino

option one - default.aspx iset set as the default in the IIS
option two - can you give me an example of such an entry?

I do have an entry but not where you say
<modules runAllManagedModulesForAllRequests="true" />
<defaultDocument>
<files>
<clear />
<add value="default.aspx" />
<add value="Default.htm" />
<add value="Default.asp" />
<add value="index.htm" />
<add value="index.html" />
<add value="iisstart.htm" />
</files>
</defaultDocument>

option 3 - I don't know what you mean. I can see the page url and after the query string, it has no url redirect value only 2f because it's not picking up a particular page that was requested when i just type the domain name in. It DOES works if I type in domainname/default.aspx. Then that page shows up in the return url value after the query string on the login page

madgino

option 2, in web.config

<authentication mode="Forms">
      <forms loginUrl="Login.aspx" protection="All" timeout="10" name="AuthCookie" path="/" requireSSL="true" slidingExpiration="true" defaultUrl="default.aspx" cookieless="UseDeviceProfile" enableCrossAppRedirects="false">
      </forms>
</authentication>

Open in new window

option 3

if (FormsAuthentication.Authenticate(UserName.Value, UserPass.Value))
{
	if (FormsAuthentication.GetRedirectUrl(UserName.Value,false)!="")
    {
        FormsAuthentication.RedirectFromLoginPage(UserName.Value, true);
    }
    else
    {
        FormsAuthentication.SetAuthCookie(UserName.Value, true);
        response.redirect("default.aspx",true);
    }
}
else
{
    Msg.Text = "Invalid Credentials: Please try again";
}

Open in new window

Arnold Layne

ASKER

Okay, won't option 2 and 3 always redirect to default.aspx?

RedirectFromLoginPage uses a url recorded in the query string you see in the login page that saves what the requested page was and uses it to redirect to that page after successful. So if I tried to go directly to mydomain.com/frib.aspx, and haven't signed in, it is supposed to redirect to the login page and put frib.aspx in the query string so that it goes to that page rather than default.aspx if that was the page i was trying to get to.

So am i missing something?

One thing that I know is that the requested page has to be in the url query string of the login page to tell RedirectFromLoginPage where to go after successful login. Sometimes they may want to go directly to a sub page, or their login has timed out, so a value of either the requested page or the current page they were on has to show up in the query string when the login page comes up.

It does show up in the query string if I try to access an explicit page, but if I just type in domainname.com, expecting it to default to default.aspx, as it has done before I added the password stuff, no page shows up in the query string of the url of the login page.

So I'm giving you lots of hints, and i actually know what I'm doing, but I just can't seem to figure this one out. Maybe it's because I'm running off of localhost when i access it internally and somehow my IIS or something else is not set up correctly?

ASKER CERTIFIED SOLUTION

madgino

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Arnold Layne

ASKER

But if I merely type in mydomain.com, default.aspx doesn't show up in the query string of the URL of the login page to make the RedirectFromLoginPage method on login.aspx.cs know which original page that the user was trying to get to if they typed in mydomain.com. If a specific page after the domain name is typed in, such as mydomain.com/default.aspx. or even mydomain.com/frib.aspx, then default.aspx and frib.aspx show up in the query string of the login page url and the RedirectFromLoginPage method has a page to use as an argument for it's method call for where to redirect to after successful login.

I'm sorry if I am either explaining this so badly, or I just don't understand something, but I read the documentation of the RedirectFromLoginPage method, and it needs a page value from the login.aspx query string of it's url in order to redirect somewhere.

I'm sorry if I'm being completely clueless, but i have "some" understanding of these things.. i read the documentation of the RedirectFromLoginPage method. So am i missing something completely obvious in your explanation? If so, i apologize, but can you spell it out for me? Thank you.

Arnold Layne

ASKER

Sorry, I was missing something. Thanks.