Security on page

[=?Utf-8?B?Tkg=?=]

I am trying to restrict users access to certain pages in my asp.net 2.0 app.

What I have done is I check the users permissions (based on data stored in
database) on the page load event of the page. If they dont have access I just
do a response.redire ct to another page.

So it works something like this..

Page Load Event
If ispostback=fals e then
if userHasPermissi on = false then
response.redire ct("somewhereel se.aspx")
end if
end if

Should I be doing this check on some other page event, or is there a way a
smart user could bypass this check and get access to the page?

[Eliyahu Goldin]

Re: Security on page

If you can put all the pages with the same rights into one folder, you
should rather setup the <authorizations ection in the web.config. That is
the place where you grant or deny access to pages, no coding required.

http://support.microsoft.com/kb/316871

--
Eliyahu Goldin,
Software Developer
Microsoft MVP [ASP.NET]

http://msmvps.com/blogs/egoldin

"NH" <NH@discussions .microsoft.comw rote in message
news:940E170A-BE98-42FC-A8A8-E7CF62CB8946@mi crosoft.com...

>I am trying to restrict users access to certain pages in my asp.net 2.0
>app.
>
What I have done is I check the users permissions (based on data stored in
database) on the page load event of the page. If they dont have access I
just
do a response.redire ct to another page.
>
So it works something like this..
>
Page Load Event
If ispostback=fals e then
if userHasPermissi on = false then
response.redire ct("somewhereel se.aspx")
end if
end if
>
Should I be doing this check on some other page event, or is there a way a
smart user could bypass this check and get access to the page?
>
>

[Leon Mayne]

Re: Security on page


"NH" <NH@discussions .microsoft.comw rote in message
news:940E170A-BE98-42FC-A8A8-E7CF62CB8946@mi crosoft.com...

>I am trying to restrict users access to certain pages in my asp.net 2.0
>app.
>
What I have done is I check the users permissions (based on data stored in
database) on the page load event of the page. If they dont have access I
just
do a response.redire ct to another page.
>
So it works something like this..
>
Page Load Event
If ispostback=fals e then
if userHasPermissi on = false then
response.redire ct("somewhereel se.aspx")
end if
end if
>
Should I be doing this check on some other page event, or is there a way a
smart user could bypass this check and get access to the page?

It depends on how you are deriving userHasPermissi on. If this is pulled out
of a cookie value or querystring data then it's possible that a user could
bypass it. If possible you may be better off using Forms Authentication in
your application which will do all this processing for you.

[=?Utf-8?B?SklHTkVTSA==?=]

RE: Security on page

There is not need to check Permission on each page.

I feel you should look at MemberShip & Role features of ASP.NET
Also
Check <locationtag of web.config

After quick study of above you should get some good alternative ways.

Regards
JIGNESH.

"NH" wrote:

I am trying to restrict users access to certain pages in my asp.net 2.0 app.
>
What I have done is I check the users permissions (based on data stored in
database) on the page load event of the page. If they dont have access I just
do a response.redire ct to another page.
>
So it works something like this..
>
Page Load Event
If ispostback=fals e then
if userHasPermissi on = false then
response.redire ct("somewhereel se.aspx")
end if
end if
>
Should I be doing this check on some other page event, or is there a way a
smart user could bypass this check and get access to the page?
>
>