I have successfully created authentication via web.config however I
discovered some security issues as follows:
1. ASPX Security
I have web application via asp.net and it is consist of following sections:
i. Administration
ii. Attendance
iii. Reporting
Each section has it own authorise user and it should not cross over.
Example, User A can login Administration but cannot access Attendance and
Reporting. How do I control it? Please help.
2. Login Security
How long web config allow use to access web application? How do aspx file
check whether user still can access or not?
Please find web.config and login.aspx files.
<!-- Web.Config Configuration File -->
<configuratio n>
<appSettings>
<add key="Connection String"
value="server=K ULSQL01;databas e=Payroll;uid=p ayroll;pwd=pay8 8;" />
</appSettings>
<system.web>
<compilation debug="true" />
<authenticati on mode="Forms">
<forms name="Intranet" loginUrl="authe ntication.aspx"
protection="All " path="/" timeout="20"/>
</authentication>
<authorizatio n>
<deny users="?"/>
</authorization>
<customErrors mode="Off" />
</system.web>
</configuration>
<!-- Login Authentication File -->
<%@ Page Language="VB" %>
<%@ import Namespace="Syst em" %>
<%@ import Namespace="Syst em.Configuratio n" %>
<%@ import Namespace="Syst em.Data" %>
<%@ import Namespace="Syst em.Data.OleDB" %>
<%@ import Namespace="Syst em.Data.SqlClie nt" %>
<%@ import Namespace="Syst em.Data.SqlType s" %>
<%@ import Namespace="Syst em.Web.Security " %>
<script runat="server">
Sub defaultpage(Sen der as Object, e As EventArgs)
Response.Redire ct("default.asp x")
End Sub
Sub authenticate(Se nder as Object, e As EventArgs)
Dim con As New
SqlConnection(C onfigurationSet tings.AppSettin gs("ConnectionS tring"))
Dim cmd As New SqlCommand()
cmd.CommandText = "Select * from authentication where username ='"
& txtUsername.Tex t & "'"
cmd.Connection = con
Try
con.Open()
Dim FlagAuthenticat ion
FlagAuthenticat ion = "N"
Dim rd As SqlDataReader = cmd.ExecuteRead er()
While rd.read()
If rd("password"). ToString = txtPassword.Tex t Then
FormsAuthentica tion.RedirectFr omLoginPage(txt Username.Text,
false)
FlagAuthenticat ion = "Y"
Response.Redire ct("payroll.asp x")
Else
Response.Redire ct("warning.asp x")
End If
End While
rd.Close()
If FlagAuthenticat ion = "N"
Response.Redire ct("warning.asp x")
End If
Finally
con.Close()
End Try
End Sub
</script>
