Security
I am building a asp.net website and creating a session when user login stores UID and checks each time when user tries to access othe pages whether user had loggedin by checking the whether session is set is it the best way to maintain guest not access pages of my website without login
Andrew FensterPosted Mar 22, 2011, 8:13 AM
There are a few things you can do. Most important, you can set your pages to tell the browser not to cache. That is, you can't tell the browser to delete its cache, but you can tell it not to cache your pages in the first place. The problem with this is that your pages will be much slower because the browser isn't caching. Still, if you are making something where security is extremely important, that's what you have to do.
There are other tricks which are less reliable. For example, when a user logs out, I sometimes redirect them to a page which has Javascript. The Javascript instantly redirects the user to a third page. Now, when they hit the back button, they end up on the Javascript page again. In some browsers (not all), the Javascript will execute again, redirecting them again. So they wind up in the same place even when they hit the back button. It doesn't work with all browsers. It doesn't prevent the user from using their history to go back two screens instead of one. Still, it has some limited benefit.
There are hundreds of articles discussing what to do in this situation. Unfortunately, other than preventing caching, there are no really good solutions.
kalpa vachhaniPosted Mar 22, 2011, 7:41 AM
Purushottam RathorePosted Mar 22, 2011, 12:30 AM
Suppose you have stored the userid in session like
Session["UserId"]="userId";
Now you have to check the session is not null to access the page like as follows-
protected void LinkButtonGoToMyAccount_Click(object sender, EventArgs e)
{
if (!object.Equals(Session["UserId"], null))
{
Response.Redirect("MyAccount.aspx");
}
else
{
Response.Redirect("Login.aspx");
}
}
Andrew FensterPosted Mar 22, 2011, 12:17 AM
Forms security is easy to do, but it's too complicated to explain in a forum answer. You'll need to read up on it. It's the easiest way to accomplish what you're trying to accomplish.