FormsAuthentication.SignOut and default.aspx

[c83]

Hi everyone!!
I have a litle problem with an ASP.net application.
My default.aspx page can be accessed only by the registered users.
after user signs-out, it is transfered to the login.aspx form:

FormsAuthentication.SignOut();
Response.Redirect('login.aspx');

The problem is that if i type in the browser http://localhost/website/default.aspx the page is accesible. Why??
All the other pages can-t be accesed directly.
I think the problem is in the name of the page 'default.aspx'.
How to secure the default.aspx page???

p.s. my web.config

<authorization>
 <deny users="?" />
</authorization>

[nateraaaa]

Hi everyone!!
I have a litle problem with an ASP.net application.
My default.aspx page can be accessed only by the registered users.
after user signs-out, it is transfered to the login.aspx form:

FormsAuthentication.SignOut();
Response.Redirect('login.aspx');

The problem is that if i type in the browser http://localhost/website/default.aspx the page is accesible. Why??
All the other pages can-t be accesed directly.
I think the problem is in the name of the page 'default.aspx'.
How to secure the default.aspx page???

p.s. my web.config

<authorization>
 <deny users="?" />
</authorization>

In the Page_Load event of default.aspx are you checking to see if there is a logged in user? If not you should add some code that will redirect the user to the login.aspx if there is no Session or Cookie created for the user. Give that a try and let us know what you get.

Nathan

[radcaesar]

Calling the SignOut method only removes the forms authentication cookie. The Web server does not store valid and expired authentication tickets for later comparison.
In each page load of each page you should have to check it yourself.

Set a session value when authentication is success.
Check that value on all the page loads else redirect to login page.

:)

[c83]

Calling the SignOut method only removes the forms authentication cookie. The Web server does not store valid and expired authentication tickets for later comparison.
In each page load of each page you should have to check it yourself.

Set a session value when authentication is success.
Check that value on all the page loads else redirect to login page.

:)

I found that after signout the last visited page was accesible, i thought that it was a page caching problem so I added this to my aspx page:

<%@ OutputCache Duration="1" VaryByParam="none"%>

and i must say that it is working. Is this a good ideea or i should do some other checking??