Classic ASP: Show/Hide the nav link issue due to session variable

Question

I have to show a link(Products) in the header after user login to the application. It fail to display the link at first but if I refresh the page the link appears and it logout from the application. The problem is, initially the session variable(LoginID) were I'm using to check in the condition is null, after I refresh the page the appropriate value sets in the same. The three separate page are link in the header page, the form in login page and the codebehind in the Login.asp page. Please suggest me what I'm missing here.

header.asp

Dim qcVisible, LoginID
                
LoginID=Session("LoginID")
if Session("LoginID")="invaliduser" or Session("LoginID")="" Then                 
     qcVisible = "none"  
else                  
     qcVisible = "block"     
end if

<div class="menu">
    <ul class="clearfix">
       <li class="active"><a href="home.asp">Home</a></li> 
       <li><a href="Products.asp" style="display:<%=qcVisible%>;">Products</a></li>                                
       <li><a href="#">Contact</a></li>
    </ul>
</div>

Mylogin.asp(Form)

<!--#include file="header.asp"-->

Session("LoginID")="validuser"

<form name="MyForm" method="post" action="Login.asp" id="loginform">
    <fieldset>
        <div class="field">
           <input type="text" name="LoginID" placeholder="User ID" id="LoginID" />
        </div>
        <div class="field">
            <input type="password" name="PWD" placeholder="Password" id="PWD" />                                        
        </div>                                    
        <div class="field">                                                                          
            <button class="field_bt" type="submit" form="loginform" name="submit1">Sign In</button>
        </div>
    </fieldset>
</form>
            

Login.asp

Login(Request.Form("LoginID"),Request.Form("PWD"))


Function Login(LoginID,Password)
  Dim objRS,strSQL
  Set objRS=Server.CreateObject ("ADODB.Recordset")
 `strSQL = Query
  objRS.Open strSQL,objconn
  If not objRs.Eof and not objRS.Bof then  
     dim muser
     muser = Mid(objRS("user_password"),1,3)
     dim mpass
     mpass = Mid(Password,1,3)      
     If trim(muser)= trim(mpass) Then
         Login=True
         Session("LoginID")=LoginID
         Session("Password")=Password
     Else
         Login=False
     End If
  End If
  objRS.Close
  Exit Function
End Function

<div class="maincontent">
    <object id="obj" data="Mylogin.asp" type="text/html"></object> 
</div>

Before Login

After login and refresh the page, its logout and the link shows.

Any help would be appreciated. Thanks.

Edited Based on the member suggestion I tried the following

'If Request.Form.Count > 0 Then(Another Way)

 If Request.ServerVariables("REQUEST_METHOD") = "POST" Then
      if Session("LoginID")="invaliduser" or Session("LoginID")="" Then                         
          qcVisible = "none"  
      else                          
          qcVisible = "block"     
      end if
 End If

Answer 1

There are a couple things wrong with your approach:

1. Session("LoginID") should either have no value (logged out) or a value (logged in).

2. You are tasking the clientside of hiding the link which can be defeated by looking in the browser's DevTools or source code.

To solve these issues:

#1: Only set Session("LoginID") when a log in is successful.

#2: Your Product-check should look like this to only generate the HTML if the user is logged in (remeber that the session should ONLY have a value if logged in):

   <% If Session("LoginID") <> "" Then %><li><a href="Products.asp" style="display:<%=qcVisible%>;">Products</a></li><% End If %>

Answer 2

in your code you set the visible to none if the loginID is empty string when you first load the page what do you think it is??:

if Session("LoginID")="invaliduser" or Session("LoginID")="" Then                 
     qcVisible = "none" 

Then later on you go:

<li><a href="Products.asp" style="display:<%=qcVisible%>;">Products</a></li>   

it is equilvalent to going:

<li><a href="Products.asp" style="display:none;">Products</a></li>   

Before you actually refresh the page or login....

Instead you might want to try:

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     //Do your styles in here
}else{
qcVisible = "block";
}

Usually when you load a webpage a GET request is sent, and if you refresh it or click submit the request you specified on your form will be sent in your case POST, so when the user did not enter anything you want to display product hence it will be in the else statement..... Otherwise you want to check if it is valid or not... :)