sessions in asp

[mubarak basha]

hi,

At present am doing one website project. In this project i have to secure my website on that session only......If the user copy and paste the url of intermediate pages of my website to another browser page means it wont be display......
how can i write the coding???? please suggest me........Thank You...

[cbrao]

Have an include file at top of all files. Check for logged user ID in session variable and if not available, redirect him to login page.

[sashi]

Hi Mubarak,

please refer to below sample.. hope it helps.. good luck my fren..

under your login function.. if the user is validated and has access to your application set the session to yes..

<%
   Session("isLoggedIn")   = "yes"
%>
 

on the page that you wish to protect..

<%
  If Session("isLoggedIn") <> "yes" Then
    Response.Redirect "access_denied.asp"
  End If
%>
 

[danp129]

If you also want to add a little bit of protection against session hijacking, change sashi's code to:

<%
Session("isLoggedIn")   = "yes"
Session("security") = Request.ServerVariables("REMOTE_ADDR") & " " & _
  Request.ServerVariables("HTTP_USER_AGENT")
%>
 

And this to the top of each page you want to protect:

<%
  If (Session("isLoggedIn") <> "yes") or _
        (session("security") <> Request.ServerVariables("REMOTE_ADDR") & " " & _
        Request.ServerVariables("HTTP_USER_AGENT")) Then
    Response.Redirect "access_denied.asp"
  End If
%>
 

This will verify that their IP didn't change and are using same browser as the person that logged into that session.

[sashi]

hi Dan,

thanks for the idea and info.. take care my fren.. :)

[shwaqar82]

Hi Guys

Im currently working on a project which shows the result coming from another server. Our server is hosting the html web form in aspx page and when user submitting the form it goes directly to another server having the same form selecting the same form values thyr, appending with URL by get method. The only prob im facing is to get session id of remote form. Like we have a link to that form which is "http://www.watever.com/form.aspx". I need to get the session id of this form to append to its URL which is "http://www.watever.com/form.aspx?no_hot=marriot&host=me&sid="

I need to get sid value to append to the above URL. Any help or sample piece of code wud be great.

Best Regards
Shaukat Waqar

[sashi]

Hi Shaukat,

well.. i suggest using quesrystring method.. since [sid] is passed on as a querystring you can capture the value stored in [sid] with request querystring method.. see below sample code segment..

  Dim nSid
 
    nSid = Request.QueryString("sid")