How to restrict unlogged/unauthorized users from viewing web pages in ASP.NET

Question

I have some created web forms and I need to check whether the user is authenticated or not, before displaying the other web forms. All the users can access Default.aspx and About.aspx pages. And I have three types of users namely- Admin,User and Super User. Also, I keep the authentication details in my own SQL server db.

How can I do this? Thanks in advance!

score 2 · Accepted Answer · answered Sep 23 '12 at 09:18

First establish membership and role provider. There is whole story about it. I will give a help here.

Here is link to SqlMembershipProvider (one of the options you can take): http://msdn.microsoft.com/en-us/library/system.web.security.sqlmembershipprovider.aspx

Here is link to SqlRoleProvider (again only one of the options you can take):: http://msdn.microsoft.com/en-us/library/system.web.security.sqlroleprovider.aspx

After you have established this you can limit user/role access on folder level. Put this code to web.config (inside configuration tag):

  <location path="AdminPages">
    <system.web>
      <authorization>
        <allow roles="Administrator"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>
  <location path="UserPages">
    <system.web>
      <authorization>
        <allow roles="Administrator,User"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

Here is little explaination. Root folder "AdminPages" will be alowed only to users in role "Administrators". Root folder "UserPages" to users in role "Administrator" and "User". In both cases unknown users will not be allowed to access folders. This is all you need. Alternative to this is to create class that inherits from Page and then there handle page access... however I would not go that way.

Thank you MaDu_LK. You can vote this answer as "Acepted answer" if you are satisfied with it. Happy coding! — Gregor Primar, Sep 23 '12 at 14:05
But I have another one small problem here. I have put into the folders named as AdminPages and UserPages. And I used . Then it identifies second page as AdminPages/AdminPages/PageName2.aspx and gives an error. I am doing these things using site master. Please help. — Madusanka, Sep 24 '12 at 01:44
I have corrected the problem using asp hyperlink tag instead of html anchor tag. Thank you Gregor Primar. — Madusanka, Sep 24 '12 at 06:46

How to restrict unlogged/unauthorized users from viewing web pages in ASP.NET

1 Answers1

Linked