Member Avatar for Alv45525

helo guys...am doing my website in asp.net and its gonna be an ecommerce site with shopping cart and all..I learned that i will need to makke use of session in the login form and pass it to the other forms...can anyone help and gimme some explanation

  • 4 Contributors
  • 9 Replies
  • 199 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Alv45525

Dani AI

Generated

Short answer: the app must enforce authentication/authorization on the server for every protected page — not just on the page you land on after login. Checking a Session variable on one page alone lets someone type a direct URL and hit an unprotected page. There are two practical, maintainable options: use ASP.NET’s built‑in forms authentication + authorization rules in Web.config, or centralize a server‑side check (BasePage or an HttpModule) that every protected page inherits/uses. See Microsoft guidance on controlling authorization and protecting pages. (learn.microsoft.com)

For an ecommerce site prefer Forms Authentication (so ASP.NET handles the cookie, ReturnUrl and redirects) and combine that with role or membership checks for admin vs. customer areas. Example approach: enable forms auth in Web.config and deny anonymous users for the protected folders; leave specific pages public with <location> entries. This is more robust than relying only on ad‑hoc Session checks. See Microsoft’s forms‑based auth how‑to. (learn.microsoft.com)

Session tips and security cautions: use Session for small, transient data (user id, cart id), never store raw passwords or full card numbers, and expect session timeouts or app‑pool recycles. Always use HTTPS, set auth/session cookies Secure and HttpOnly, and regenerate identifiers on privilege changes to reduce fixation/hijack risk. Follow standard session management best practices (OWASP) and the ASP.NET session state guidance. (cheatsheetseries.owasp.org)

Quick checklist you can apply now:

  • Centralize the server‑side auth check (BasePage or HttpModule) rather than repeating per page.
  • Use Web.config <authentication>/<authorization> rules for folder‑level protection.
  • Use FormsAuthentication (or membership/roles) for login + role checks.
  • On login page, detect an already‑authenticated user and redirect them away.
  • Test direct URL access, logout + back button, and session timeout behavior.

Good start from and — their session checks are the right concept for learning. For production, move to the declarative/authentication patterns above and add the security items listed.

Recommended Answers

All 9 Replies

Member Avatar for ninjaimp

create a session like this

session("MySessionName") = me.txtUsername

you can then use this session in other or same page by calling like this

me.txtUsername = session("MySessionName")

have a look here gives a good overview on the session object
http://www.w3schools.com/ASP/asp_sessions.asp

Member Avatar for mail2saion

HI TO LEARN PASSING DATA WITHIN ASP.NET PAGE THE BELOW LINK IS MUST READ:

Member Avatar for greeny_1984

Hi,

First you need to have a login table to store user data like userid and username.

In the login page create a

session["userid"].

In this session assign the user name from login table when a user logs in and check this session in every page of your webiste like this

if(Session["username"].TOstring()=="")
response.redirect("login.aspx");

In this way you can redirect user who didnt login to login page.

Member Avatar for Alv45525

Hi,

First you need to have a login table to store user data like userid and username.

In the login page create a

session["userid"].

In this session assign the user name from login table when a user logs in and check this session in every page of your webiste like this

if(Session["username"].TOstring()=="")
response.redirect("login.aspx");

In this way you can redirect user who didnt login to login page.

can u plz explain me more precisely?? look i have a login form. and when i login, it redirects me to certain pages allowed to either user or administrator. but when i change the page.aspx name from the address bar of my browser, it is giving me pages that one should not have acccess to...i found out that i should use session..but am kinda lost in this area..plz gimme a helping hand.

Member Avatar for ninjaimp

have a look here
http://www.w3schools.com/ASP/asp_sessions.asp

it shows you how to create and set sessions.

You can set the sessions with the username of the person who logs in.

Use this session in your your page_load events on your pages in the site to check if it exists. if it doesnt, then they have not logged in (the session isnt there and hasnt been created yet) so redirect back to the login page with response.redirect!

hope that helps

Member Avatar for Alv45525

thx i try to take a look...if any other idea..plz let me knw..thx

Member Avatar for Alv45525

ok on my login page i put

Session("UserName") = Request("txtUserName")
            'Session.Timeout = 5
            Response.Redirect("default.aspx")

then on my default page i put

If (Session("UserName") Is Nothing) Then
            Response.Redirect("login.aspx")
        End If

it works..but now the problem is that once login and that the user is directed to the default.aspx page, if login.aspx is typed in the address bar, it bring me to login.aspx page which is wrong...any solution?

Member Avatar for ninjaimp

at the top of you login page

if Session("UserName") <> ""  Then
 Response.Redirect("default.aspx")
End If
Member Avatar for Alv45525

at the top of you login page

if Session("UserName") <> ""  Then
 Response.Redirect("default.aspx")
End If

It works great thx

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.