CodeVerge.Net Beta


   Explore    Item Entry    Members      Register  Login  
NEWSGROUP
.NET
Algorithms-Data Structures
Asp.Net
C Plus Plus
CSharp
Database
HTML
Javascript
Linq
Other
Regular Expressions
VB.Net
XML

Free Download:
Zone: > NEWSGROUP > Asp.Net Forum > general_asp.net.security Tags:
Item Type: NewsGroup Date Entered: 5/9/2004 2:58:39 PM Date Modified: Subscribers: 0 Subscribe Alert
Rate It:
(NR, 0)
XPoints: N/A Replies: 5 Views: 19 Favorited: 0 Favorite
Can Reply:  No Members Can Edit: No Online: Yes
6 Items, 1 Pages 1 |< << Go >> >|
alanmdunsmuir
Asp.Net User
Trying out Forms Authentication5/9/2004 2:58:39 PM

0/0

Having just read up on the wonders of Forms authentication in ASP.NET, I decided to try it out, to check that I had understood properly what I had just read (in "Using Forms Authentication in ASP.NET", from 4GuysFromRolla.com).

I have a test-bed ASP.NET application (called WebTest1) which I use for trying out new concepts. It consists of WebForm1.aspx and WebForm2.aspx, with the former set as the 'starting page' for the application. So, using VS.NET, I added a WebForm3.aspx as a login page, and added <forms name=".ASPXAUTH" loginUrl="WebForm3.aspx" /> to the authentication section of the application's Web.config file. In its authorization section I specified <deny users = "*" />.

When I ran the application on my development IntraNet, the redirection appeared to work perfectly, and I was presented with the new login form rather than the old 'starting page', WebForm1.aspx. However, when I entered a valid UserName and Password, and clicked the Submit button, the login form persisted, instead of passing me to WebForm1.aspx.

I then noticed that the 'redirect' parameter in the Url at the top of the Browser window showed, instead of a 'clean' reference to WebForm1.aspx, the following:

http://localhost/WebTest1/WebForm3.aspx?ReturnUrl=%2fWebTest1%2fWebForm1.aspx

Is this what is causing MSIE not to load WebForm1.aspx?

What am I doing wrong?
Alan M Dunsmuir
ranganh
Asp.Net User
Re: Trying out Forms Authentication5/10/2004 4:14:20 AM

0/0



hi,

where do you keep the username and password for the login details.

if you are keeping it in the web.config, the redirection would happen automatically.

if you are keeping it in a database, you have to redirect the page based on the validity of the user name and password as follows:- 






FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);



the above line of code you should put once you get the user validated i.e. username and password are correct.


the ReturnURl in the browser is the parameter which Forms authentication uses to recognize from where the user tried to access the page, so that after logging in, it can take him to the initially requested page.


hope this helps
regards,
Harish

http://geekswithblogs.net/ranganh
alanmdunsmuir
Asp.Net User
Re: Trying out Forms Authentication5/10/2004 4:16:20 PM

0/0

For this test of Form Authentication, I am keeping it hard-coded in the .aspx.vb file associated with the login page, as follows:

Private Sub btnSubmit_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnSubmit.Click
If MyMethod(tbxName.Text, tbxPass.Text) Then
System.Web.Security.FormsAuthentication.RedirectFromLoginPage(tbxName.Text, False)
Else
lblMessage.Text = "Invalid Login"
End If

End Sub

Function MyMethod(ByVal strUserName As String, ByVal strPassword As String) As Boolean
If strUserName = "Alan" And strPassword = "foobar" Then
MyMethod = True
Else
MyMethod = False
End If
End Function

Following the logic flow with VS.NET debugging, I can confirm that the line:

System.Web.Security.FormsAuthentication.RedirectFromLoginPage(tbxName.Text, False)

is executed if the single valid UserName and Password are entered. But when this happens, control fails to be passed to WebForm1.aspx, which is the page specified as the 'starting page' for the application, but remains instead with the login page, WebForm3.aspx.
Alan M Dunsmuir
alanmdunsmuir
Asp.Net User
Re: Trying out Forms Authentication5/11/2004 5:03:22 AM

0/0

The problem is solved.

I had been using

<deny users = "*" /> instead of

<deny users = "?" /> in my Web.config file, thinking the two options were equivalent. It appears that they are not.
Alan M Dunsmuir
ranganh
Asp.Net User
Re: Trying out Forms Authentication5/11/2004 1:17:55 PM

0/0



hi,

let me clarify if you, if you want:-

<deny users="*" /> will deny all the users except for the ones you specify.

say that you have a page for only admin, you can use as follos:-

<deny users="*" />
<allow users="admin" />

however, in case you want to deny only anonymous users (those who havent logged in), we can give as

<deny users="? />

hope it helps.

regards,
Harish

http://geekswithblogs.net/ranganh
alanmdunsmuir
Asp.Net User
Re: Trying out Forms Authentication5/11/2004 4:13:16 PM

0/0

Thanks, Harish.
Alan M Dunsmuir
6 Items, 1 Pages 1 |< << Go >> >|


Free Download:

Books:
Beginning Visual Basic 2005 Authors: Thearon Willis, Bryan Newsome, Pages: 799, Published: 2006
Java Servlet Programming Authors: Jason Hunter, William Crawford, Pages: 753, Published: 2001
Pro ASP.NET 2.0 in C# 2005 Authors: Matthew MacDonald, Mario Szpuszta, Pages: 1255, Published: 2005
Pro ASP.NET 3.5 in C# 2008 Authors: Matthew MacDonald, Mario Szpuszta, Pages: 1498, Published: 2007
Programming ASP.NET: Building Web Applications and Services Using C and VB.NET. Authors: Jesse Liberty, Dan Hurwitz, Pages: 988, Published: 2003
Sams Teach Yourself C# Web Programming in 21 Days Authors: Phil Syme, Peter Aitken, Pages: 560, Published: 2001
ASP.NET 2.0: A Developer's Notebook Authors: Wei Meng Lee, Pages: 326, Published: 2005
Beginning Visual Web Programming in VB .NET: From Novice to Professional Authors: Daniel Cazzulino, Craig Bowes, Victor Garcia Aprea, Mike Clark, James Greenwood, Chris Hart, Pages: 648, Published: 2005
Pro ASP.NET 2.0 in VB 2005: From Professional to Expert Authors: Laurence Moroney, Matthew MacDonald, Pages: 1253, Published: 2006
Microsoft ASP.NET Programming with Microsoft Visual Basic .NET Step by Step: Version 2003 Authors: G. Andrew Duthie, Pages: 624, Published: 2003

Web:
ASP.NET 2.0 Membership, Roles, Forms Authentication, and Security ... NET 2.0 Membership, Roles, Forms Authentication, and Security Resources. I usually try and spend at least an hour or two each night hanging out on the ASP. ...
ASP.NET Forms Authentication, Part 2 | O'Reilly Media NET Forms Authentication with Active Directory to provide a better operating- system ... Been trying out the script but always returns "invalid credentails". ...
How to: Implement Simple Forms Authentication Please try again." End If End Sub Forms Authentication - Login 15 Seconds : Using Forms Authentication in ASP.NET - Part 2 Jeff Gonzalez continues to explain Forms Authentication, this time using a custom ... The Try...Catch statement is new to ASP and is a great way to handle ...
CodeProject: Role-based Security with Forms Authentication. Free ... Hi Tom, FormsAuthentication.SignOut() will sign out the user, but won't clear the cache memory. Try to find out yourself by sign the user out with ...
SharePoint 2007 Forms Authentication (To find out which directory is your Central admin one you’ll need to go into ..... I have forms authentication working however i get an error when i try to ...
Preventing Page Review after Logout with Forms Authentication: ASP ... The inclusion of Forms Authentication in the . ... I have been trying to implement Log out functionality in my page and i need to restrict users with no ...
Scott Hanselman's Computer Zen - ViewStateUserKey and ... Feb 9, 2005 ... Exception occurs, because we now are trying to decrypt ViewState with a key ... Redirect after the Forms Authentication Cookie is sent out. ...
Forms Authentication Tutorial Find out more at www.passport.com Forms Authentication - This is a .... Give it a try. If you want to extend the usage of authentication more, read on! ...
Master simple forms authentication in .NET A persistent cookie will survive browser sessions until the user is specifically signed out (the SignOut method of the FormsAuthentication class). ...

Videos:
Baltic Amber: The Living Gemstone from Amberjewelry.com A rare look inside The International Amber Association, of which we are a certified member. The organization, now in its 11th year, is devoted to the...
The Reticulated Python. survivor Cretaceous -English- The name python comes from a mythical giant serpent in Greek mythology. Pythons are primitive snakes that, like their close relatives the b...
Introduction to Google Data Jeff Fisher walks through basic history and concepts behind the Google Data protocol. Visit the documentation for more information and list of availa...
Leveraging India As India Stands Up Google TechTalks May 25, 2006 Ashok Jhunjhunwala Prof. Ashok Jhunjhunwala is Professor of the Department of Electrical Engineering, Indian Institute...
Opencast Project Open House at UC Berkeley http://www.opencastproject.org/ Opencast is an initiative driven by higher education institutions to empower: institutions - to make informed choic...
A New Way to look at Networking Google Tech Talks August 30, 2006 Van Jacobson is a Research Fellow at PARC. Prior to that he was Chief Scientist and co-founder of Packet Design. P...
Badvertisements: Stealthy Click Fraud with Unwitting Accessories Google Tech Talks September 19, 2006 Dr. Markus Jakobsson, Associate Professor of Informatics at IUB Associate Director of CACR ABSTRACT We descri...
django: Web Development for Perfectionists with Deadlines Google TechTalks April 26, 2006 Jacob Kaplan-Moss ABSTRACT Django is one of the premier web frameworks for Python, and is often compared to Ruby-on...
PRESIDENTE LEGÍTIMO Documental de senderodelpeje.com sobre el fin de los campamentos en el Zócalo y Paseo de la Reforma en el DF, la Convención Nacional Democrática, y e...
How To Break Web Software - A look at security vulnerabilities in web software Google TechTalks April 13, 2006 Mike Andrews Mike Andrews is a senior consultant who specializes in software security and leads the web application...




Search This Site:










upgraded from dnn 1.0.9 to 1.0.10

message box

how to display column wise record

how to write help

code beside

iis web server url in project file

export data from sql server to excel

restricted area design

solpart menu and linkclick

problem to put an object into viewstat because not serializable – why?

newbie question about the survey module.

build warnings errors on clean 2.1.2 download.

trigger function from a child window

tree view performence issues & asp.net worker process locking files

client site validate

best practice opinions...

server error message

creating a pay area in dnn 2.0 b3

identify page is ideal from 5 minutes

asp.net classes

vwd 2005 ee keeps crashing my browser

where is the tab control

how can i enumerate class or control properties ?

update in datalist with dropdownlist

redirectfromlogin

free modules, source now available

instring

display the contents of a sqldatareader in a user control

pass variables from one page to another

user.identity.name
 
All Times Are GMT