How authorization works in the following case?
When a user having userid as abc with administrator rights accessess a web page, we copy the url of that page and logout. Now another user having userid xyz with lower authorization than administrator accesses the page. We paste the url. If the user xyz is not authorized then the user shouldn’t get the page without loging in.
Is it possible just having authorization or do we need to use some javascript code to delete cookie and history information?
Niradhip ChakrabortyPosted May 4, 2009, 1:36 AM
You can handle it manually also. You can create a session and assign some value to it while validating the user in login page. Now you can again validate in the starting of all the pages after login. Check for the session value. If it is not matching then redirect it to again in login page. Release the session value in the time of logout.
So session is having value only during proper authentication time of login. if user name and password match then before redirecting to desire page assign the value to session.
Now if some one copied the URL and paste it then it will redirect to login page because session will be empty or null.
vivek kulkarniPosted May 2, 2009, 3:20 PM
Hi Shradha,
The UrlAuthorizationModule determines whether the current user is permitted access to the requested URL, based on the user Name or the list of roles that a user is a member of. For information about how the user name is determined, see ASP.NET Authentication. For information about how to manage user roles, see Managing Authorization Using Roles.
Authorization for a user or a role is managed using the authorization configuration element. You can allow or deny a user or a role using the allow or deny subelements, respectively. The allow and deny subelements are interpreted in the order they appear in the configuration. Once an element specifies that access is allowed or denied, the UrlAuthorizationModule completes its authorization check. For example, the following authorization section from a Web.config file requires users to log on (by denying anonymous users), and then allows only users in the Administrators role to have access. Users not in the Administrators role are denied.