Member Avatar for sonia sardana

WEB.CONFIG FIlE

<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
      <authentication mode ="Forms">
        <forms loginUrl="FrmLogin.aspx" protection="All" >
          <credentials passwordFormat="Clear">
            <user name="sonia" password="citm123"/>
            <user name="soni"  password="citm123" />
            <user name="muru" password="citm1234"/>
          </credentials>
        </forms>
      </authentication>
      <authorization>
       <allow users="sonia"/>
        <allow users ="soni"/>
        <deny users="muru"/>
         </authorization>
      <compilation debug="true"/>
         </system.web>
</configuration>

FRMLOGIN.aspx

protected void btnLogin_Click(object sender, EventArgs e)
    {
        if (FormsAuthentication .Authenticate(txtUserName .Text ,txtPassword .Text ))
        {
         FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, true);

          Response.Redirect("FrmWelcome.aspx?username=" + txtUserName.Text  );
        }

    }

FRMWELCOME.aspx

protected void Page_Load(object sender, EventArgs e)
    {
       
            lblUserName.Text = Request.QueryString["username"].ToString();  

               
    }

Suppose i enter sonia in username & citm123 in password. I will be redirected to FrmWelcome. Suppose now the user copies the URL of FrmWelcome & open in other window,i want that the user is navigated to FrmLogin. How to do it.Using Cookies??? Can somebody help me out!

  • 2 Contributors
  • 1 Reply
  • 120 Views
  • 19 Hours Discussion Span
  • Latest Post Latest Post by Ramesh S

Dani AI

Generated

This is a classic forms-authentication issue: the browser can open FrmWelcome directly if the authentication cookie is present or if the page never checks authentication. is correct to suggest denying anonymous users and to avoid a persistent cookie when you do not want the login to survive across browser sessions. A few practical fixes and security notes follow.

Always protect the page itself (server-side). Either apply an authorization rule in web.config to block anonymous users, or verify authentication in Page_Load. Do not rely on a username passed in the query string (it can be spoofed). Instead read the authenticated identity and show that name. Also avoid calling RedirectFromLoginPage and then another Response.Redirect; RedirectFromLoginPage handles the redirect for you. If you want to redirect manually, use a non-persistent auth cookie and redirect yourself.

Example pattern for a protected page (use this instead of reading Request.QueryString):

protected void Page_Load(object sender, EventArgs e)
{
    if (!HttpContext.Current.User.Identity.IsAuthenticated)
    {
        System.Web.Security.FormsAuthentication.RedirectToLoginPage();
        return;
    }
    lblUserName.Text = HttpContext.Current.User.Identity.Name;
}

Security and hygiene checklist:

  • Do not store real user passwords in web.config with passwordFormat="Clear" in production. Use the Membership/Identity system or a database with properly hashed passwords.
  • Only set the persistent ("remember me") flag when you really want durable cookies.
  • Use HTTPS and set cookies to HttpOnly/Secure to reduce theft risk.
  • Regenerate session/auth tickets on privilege changes and call SignOut on logout.

Official references: FormsAuthentication.RedirectFromLoginPage method (docs) and IIdentity.IsAuthenticated property (docs).

Member Avatar for Ramesh S

You are only denying access to the user 'muru'. It means that users other than 'muru' can access the application anonymously.

If you want to prevent the users to access the FrmWelcom or other pages without login to the system, your web.config should be as below

<authorization>
     <allow users="sonia"/>
     <allow users="soni"/>
     <deny users="muru"/>
     <deny users="?"/>
</authorization>

The '?' in deny element prevents anonymous access to the resources.

Also the set the second argument in the statement FormsAuthentication.RedirectFromLoginPage to false.

FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);

Setting true will create a durable cookie (one that is saved across browser sessions). Therefore you need to set it as false.

Edited by Ramesh S because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.