Member Avatar for JC_2000

Hi everyone,

Can anyone tell me how you can stop users from URL Hacking your website?
So for example if you have a password and username form on the front of your website and only want authorised members to gain access to your web site.

So for example just say you had a page e.g: somepage.htm and a user who was not logged in types www.somesite.com/somepage.htm. How can you stop them from getting access to the that page if they are not logged in?

P.S: Do you have any sample code?

Please help,

Jay.

  • 3 Contributors
  • 7 Replies
  • 212 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by JC_2000

Recommended Answers

All 7 Replies

Member Avatar for JC_2000

Sorry forgot to mention, I wanted to know how this is done in ASP

Member Avatar for tgreer

Post in the ASP forum. There's nothing you can do with HTML or client-side script.

Member Avatar for JC_2000

what do you mean can i ask?

Member Avatar for tgreer

I mean, if you're asking a question about ASP, then you need to ask your question in the ASP forum:

http://www.daniweb.com/techtalkforums/forum62.html

There is no way to secure a website using only client-side code, which is the focus of this forum.

Member Avatar for Esopo

I agree you need to ask this at your language's area, but just so you know I wouldn't consider your scenario URL Hacking, since visitors are not doing anything wrong but requesting a public page.

It is your responsability as a developer to make sure pages that need to be secure ARE NOT AVAILABLE PUBLICLY (to begin with). For the most part, the best approach is using sessions and bounce off to the entry page any user that has not started a session with a password.

As the next step, security is a problem even when your URLs are not public anymore. A real hack attempt is about someone trying to get access to pages that you have already secured. To protect yourself from such attacks there are special considerations you need to keep in mind, such as sanitazing any and all user input.

Member Avatar for Esopo

BTW, just so it's out there,

You can secure areas of your site through server configuration without having to deal with programming, but since you already have ASP in mind I would suggest you use that since it gives you more control.

Member Avatar for JC_2000

No probs guys will move this topic to the ASP forum.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.