473,657 Members | 2,478 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Usage of "Request.UrlRef errer"

I've got \\root\folder\P age2.aspx that I want to controll
access to, by establishing a rule that says "previous URL
must be '\\root\folder\ Page1.aspx' (which did password
validation). The code snippet below does 1) allow valid
Page_Load if referring URL was 'Page1', and 2) disallows
Page_Load if the *initial* access attempt was PRIOR to
any valid load of 'Page2'...
<code>
// In Page_Load...
// check the prior URL and make sure our access
// came from the correct first page.
//
bool bBadRef = false;
System.Uri referrer = Request.UrlRefe rrer;
if (referrer == null)
bBadRef = true;
else
{
string csRef = "NONE";
string csRefPath = "NONE";
try
{
csRef = referrer.Absolu teUri;
csRef = csRef.ToLower() ;
csRefPath = csRef.Substring (csRef.IndexOf
("folder"));
}
catch (Exception refxc)
{
throw new Exception(csRef );
}
if (csRefPath != "folder/Page1.aspx")
{
bBadRef = true;
}
}
if (bBadRef)
{
this.Response.C lose();
return;
}
</code>

PROBLEM: If *after* I accomplish a valid access to Page2
(i.e. via Page1), then browse to a completely different
unrelated web page, I am then able to *directly* plug the
Page2 URL into my browser Address field and validation
does NOT fail! Could this be due to some kind of
caching effect that I'm not taking into account?
I'm rather new to aspx, so consider this a 'newbie'
question! Thanks!
Jim
Nov 18 '05 #1
1 3184
just use forms control and get the redir to login page on un authorised
access....

you might find the following links useful...

How To: Create GenericPrincipa l Objects with Forms Authentication (.NET
Framework Security)
Create and handle GenericPrincipa l and FormsIdentity objects when using
Forms authentication. (9 printed pages)
http://msdn.microsoft.com/library/en...secnetht04.asp
Forms Authentication Provider (.NET Framework Developer's Guide)
Forms authentication generally refers to a system in which unauthenticated
requests are redirected to an HTML form, using HTTP client-side redirection.
http://msdn.microsoft.com/library/en...onprovider.asp
Simple Forms Authentication (.NET Framework Developer's Guide)
This example presents the simplest possible implementation of ASP.NET forms
authentication. It is intended to illustrate the basic fundamentals of how
to create an ASP.NET application that uses forms authentication.
http://msdn.microsoft.com/library/en...entication.asp
Simple Forms Authentication (.NET Framework Developer's Guide)
This example presents the simplest possible implementation of ASP.NET forms
authentication. It is intended to illustrate the basic fundamentals of how
to create an ASP.NET application that uses forms authentication.
http://msdn.microsoft.com/netframewo...entication.asp
Simple Forms Authentication (.NET Framework Developer's Guide)
This example presents the simplest possible implementation of ASP.NET forms
authentication. It is intended to illustrate the basic fundamentals of how
to create an ASP.NET application that uses forms authentication.
http://msdn.microsoft.com/vcsharp/us...entication.asp
Simple Forms Authentication (.NET Framework Developer's Guide)
This example presents the simplest possible implementation of ASP.NET forms
authentication. It is intended to illustrate the basic fundamentals of how
to create an ASP.NET application that uses forms authentication.
http://msdn.microsoft.com/webservice...entication.asp
How To: Use Forms Authentication with SQL Server 2000 (.NET Framework
Security)
Implement Forms authentication against a SQL Server credential store. It
also shows you how to store password digests in the database. (12 printed
pages)
http://msdn.microsoft.com/library/en...SecNetHT03.asp
How To: Use Forms Authentication with Active Directory (.NET Framework
Security)
Implement Forms authentication against an Active Directory credential store.
(11 printed pages)
http://msdn.microsoft.com/library/en...secnetht02.asp
Forms Authentication Across Applications (.NET Framework Developer's Guide)
ASP.NET supports forms authentication in a distributed environment, either
across applications on a single server or in a Web farm.
http://msdn.microsoft.com/library/en...plications.asp

Regards,

HD

<an*******@disc ussions.microso ft.com> wrote in message
news:01******** *************** *****@phx.gbl.. .
I've got \\root\folder\P age2.aspx that I want to controll
access to, by establishing a rule that says "previous URL
must be '\\root\folder\ Page1.aspx' (which did password
validation). The code snippet below does 1) allow valid
Page_Load if referring URL was 'Page1', and 2) disallows
Page_Load if the *initial* access attempt was PRIOR to
any valid load of 'Page2'...
<code>
// In Page_Load...
// check the prior URL and make sure our access
// came from the correct first page.
//
bool bBadRef = false;
System.Uri referrer = Request.UrlRefe rrer;
if (referrer == null)
bBadRef = true;
else
{
string csRef = "NONE";
string csRefPath = "NONE";
try
{
csRef = referrer.Absolu teUri;
csRef = csRef.ToLower() ;
csRefPath = csRef.Substring (csRef.IndexOf
("folder"));
}
catch (Exception refxc)
{
throw new Exception(csRef );
}
if (csRefPath != "folder/Page1.aspx")
{
bBadRef = true;
}
}
if (bBadRef)
{
this.Response.C lose();
return;
}
</code>

PROBLEM: If *after* I accomplish a valid access to Page2
(i.e. via Page1), then browse to a completely different
unrelated web page, I am then able to *directly* plug the
Page2 URL into my browser Address field and validation
does NOT fail! Could this be due to some kind of
caching effect that I'm not taking into account?
I'm rather new to aspx, so consider this a 'newbie'
question! Thanks!
Jim

Nov 18 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

8
2216
by: Sam Sungshik Kong | last post by:
Hello! I use Python for ASP programming. I found something weird. Response.Write(Request("something")) It draws "None" when there's no value for something. Actually I expect "" instead of "None". So I changed it like
1
2500
by: Matt | last post by:
If we use GET protocol, we can use either Request("controlname") or Request.QueryString("controlname") to get the data entered by the user. But if we use POST protocol, we MUST use Request("controlname"), and Request.QueryString("controlname") won't work. I think Request("controlname") means Request.Form("controlname"), which is used for POST protocol. But seems like it works for GET protocol too. Here's the code I tested. <%
32
4128
by: James Curran | last post by:
I'd like to make the following proposal for a new feature for the C# language. I have no connection with the C# team at Microsoft. I'm posting it here to gather input to refine it, in an "open Source" manner, and in an attempt to build a ground-swell of support to convince the folks at Microsoft to add it. Proposal: "first:" "last:" sections in a "foreach" block The problem: The foreach statement allows iterating over all the...
0
3195
by: Ian Staines | last post by:
In asp the following code: Request.Servervarables("AUTH_USER") will return the header variable AUTH_USER In .NET the code Request.Servervariables("AUTH_USER") returns the server variable AUTH_USER, but if you want the header variable you must request it with Request.Headers("AUTH_USER")
4
1909
by: Ben Amada | last post by:
Hello! There are a couple of visitors (out of dozens) to this web page who are causing the following error to occur: "Object reference not set to an instance of an object." I'm actually catching this error in a Try-Catch block. I've narrowed down the possible offending code to the 3 lines below: Request.Browser.Cookies Request.UserAgent.ToString
0
1683
by: . | last post by:
http://daviderognoni.blogspot.com?locawapp - MAIN NEWS =========== * add thread * add "Request" object * new "locawapp_main" function * fixed files.py
1
4490
by: Christian Blackburn | last post by:
Hi Gang, I'm using the following code to generate a complete URL: Session("Destination") = Request.ServerVariables("Path_Info") & "?" & Request.ServerVariables("QUERY_STRING") However that seems like a lot of work. Is there one command coming off the request object that'll acomplish this? Thanks,
7
24835
by: vvkl | last post by:
I have readed a example code from MSDN about FormsAuthenticationTicket calss, but there's a line I can't understand : 'strRedirect = Request;' What's the mean in which square brackets? Thank you! A Chinese student.
7
2457
by: sami | last post by:
Hi I am trying to write a facebook application in python - I have been programming simple desktop applications till now and am not really familiar with web apps Pyfacebook is the wrapper for the REST based Facebook API - there is a simple example for its usage as shown below: def simple_web_app(request, api_key, secret_key):
0
8413
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8842
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
8740
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
8513
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
8617
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
1
6176
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
4173
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
2
1970
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
2
1733
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.