Login security in ASP.net

[Pravin A. Sable]

Hello Everybody,

I have one login page and other pages which will be shown only if user
logs successfully. If someone tries to access page without
identification then she should be directed to login page.

I have following code

after successful login I do...
Session("UserID") = txtUser.Text.Trim()
In every page_load I have code...
Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load
curUser = CStr(Session("UserID"))
If Len(curUser) = 0 Then
Response.Redirect("./Default.aspx")
End If

End Sub

and in logout button I have...
Private Sub cmdLogout_Click(ByVal sender As System.Object, ByVal e
As System.EventArgs) Handles cmdLogout.Click
Session("UserID") = ""
Session("UserName") = ""
curUser = ""
Session.Abandon()
Response.Redirect("./Default.aspx")
End Sub
but it doesn't work. Even after logging out. Other pages can be accessed
straight. I don't know why. Can someone help me? Thanks in advance.

Regards,
Pravin

[Steve C. Orr [MVP, MCSD]]

Dont' reinvent the wheel. Use the built-in Forms Authentication which
already provides this kind of functionality more gracefully than you are
doing it.
Here's more info:
http://www.dotnetbips.com/displayarticle.aspx?id=9
http://www.4guysfromrolla.com/webtech/121901-1.2.shtml
http://www.dotnetbips.com/displayarticle.aspx?id=117

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com
"Pravin A. Sable" <my***********@ccs.neu.edu> wrote in message
news:us**************@TK2MSFTNGP12.phx.gbl...

Hello Everybody,

I have one login page and other pages which will be shown only if user
logs successfully. If someone tries to access page without
identification then she should be directed to login page.

I have following code

after successful login I do...
Session("UserID") = txtUser.Text.Trim()
In every page_load I have code...
Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load
curUser = CStr(Session("UserID"))
If Len(curUser) = 0 Then
Response.Redirect("./Default.aspx")
End If

End Sub

and in logout button I have...
Private Sub cmdLogout_Click(ByVal sender As System.Object, ByVal e
As System.EventArgs) Handles cmdLogout.Click
Session("UserID") = ""
Session("UserName") = ""
curUser = ""
Session.Abandon()
Response.Redirect("./Default.aspx")
End Sub
but it doesn't work. Even after logging out. Other pages can be accessed
straight. I don't know why. Can someone help me? Thanks in advance.

Regards,
Pravin

[msnews.microsoft.com]

Exactly. You're doing it the old ASP way. Forms Auth is working great for
me.

-Max

"Steve C. Orr [MVP, MCSD]" <St***@Orr.net> wrote in message
news:eD**************@TK2MSFTNGP12.phx.gbl...

Dont' reinvent the wheel. Use the built-in Forms Authentication which
already provides this kind of functionality more gracefully than you are
doing it.
Here's more info:
http://www.dotnetbips.com/displayarticle.aspx?id=9
http://www.4guysfromrolla.com/webtech/121901-1.2.shtml
http://www.dotnetbips.com/displayarticle.aspx?id=117