ASP.NET

Forms Authentication

Please support our ASP.NET advertiser: Intel Parallel Studio Home

•

Join Date: Mar 2008

Posts: 324

Reputation: sonia sardana has a little shameless behaviour in the past

Solved Threads: 7

sonia sardana sonia sardana is offline

Offline

Posting Whiz

Forms Authentication

Sep 29th, 2009

WEB.CONFIG FIlE

 Help with Code Tags 
 ASP.NET Syntax (Toggle Plain Text) 
<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
      <authentication mode ="Forms">
        <forms loginUrl="FrmLogin.aspx" protection="All" >
          <credentials passwordFormat="Clear">
            <user name="sonia" password="citm123"/>
            <user name="soni"  password="citm123" />
            <user name="muru" password="citm1234"/>
          </credentials>
        </forms>
      </authentication>
      <authorization>
       <allow users="sonia"/>
        <allow users ="soni"/>
        <deny users="muru"/>
         </authorization>
      <compilation debug="true"/>
         </system.web>
</configuration>
<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
      <authentication mode ="Forms">
        <forms loginUrl="FrmLogin.aspx" protection="All" >
          <credentials passwordFormat="Clear">
            <user name="sonia" password="citm123"/>
            <user name="soni"  password="citm123" />
            <user name="muru" password="citm1234"/>
          </credentials>
        </forms>
      </authentication>
      <authorization>
       <allow users="sonia"/>
        <allow users ="soni"/>
        <deny users="muru"/>
         </authorization>
      <compilation debug="true"/>
         </system.web>
</configuration>

FRMLOGIN.aspx

 Help with Code Tags 
 ASP.NET Syntax (Toggle Plain Text) 
 protected void btnLogin_Click(object sender, EventArgs e)
    {
        if (FormsAuthentication .Authenticate(txtUserName .Text ,txtPassword .Text ))
        {
         FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, true);
 
          Response.Redirect("FrmWelcome.aspx?username=" + txtUserName.Text  );
        }
 
    }
 protected void btnLogin_Click(object sender, EventArgs e)
    {
        if (FormsAuthentication .Authenticate(txtUserName .Text ,txtPassword .Text ))
        {
         FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, true);

          Response.Redirect("FrmWelcome.aspx?username=" + txtUserName.Text  );
        }

    }

FRMWELCOME.aspx

 Help with Code Tags 
 ASP.NET Syntax (Toggle Plain Text) 
 protected void Page_Load(object sender, EventArgs e)
    {
 
            lblUserName.Text = Request.QueryString["username"].ToString();  
 
 
    }
 protected void Page_Load(object sender, EventArgs e)
    {
       
            lblUserName.Text = Request.QueryString["username"].ToString();  

               
    }

Suppose i enter sonia in username & citm123 in password. I will be redirected to FrmWelcome. Suppose now the user copies the URL of FrmWelcome & open in other window,i want that the user is navigated to FrmLogin. How to do it.Using Cookies??? Can somebody help me out!

•

Join Date: Jun 2009

Posts: 449

Reputation: Ramesh S will become famous soon enough

Solved Threads: 82

Ramesh S

Offline

Posting Pro in Training

Re: Forms Authentication

Sep 30th, 2009

You are only denying access to the user 'muru'. It means that users other than 'muru' can access the application anonymously.

If you want to prevent the users to access the FrmWelcom or other pages without login to the system, your web.config should be as below

 Help with Code Tags 
 ASP.NET Syntax (Toggle Plain Text) 
<authorization>
     <allow users="sonia"/>
     <allow users="soni"/>
     <deny users="muru"/>
     <deny users="?"/>
</authorization>
<authorization>
     <allow users="sonia"/>
     <allow users="soni"/>
     <deny users="muru"/>
     <deny users="?"/>
</authorization>

The '?' in deny element prevents anonymous access to the resources.

Also the set the second argument in the statement FormsAuthentication.RedirectFromLoginPage to false.

 Help with Code Tags 
 ASP.NET Syntax (Toggle Plain Text) 
 FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);
 FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);

Setting true will create a durable cookie (one that is saved across browser sessions). Therefore you need to set it as false.