ASP .NET – Allowing Authenticated users to see web application pages only

If you have implemented log-in, log-out capability in your ASP based Web Application then one of the main goals is to make sure unauthorized users do not get access to the pages within your web application. In other words, they must first login in order to get access to any information contained in the rest of the pages of the web application

                To make my point clear, lets assume we have a web application which is composed of 3 aspx pages:

1.  Login.asp
   
2. Profile.aspx
   
3. Preferences.aspx
   

And we want user to land on Login.aspx first, enter their username and password and then get redirected to Profile.aspx and after filling out all the fields on Profile.aspx, Preferences.aspx is displayed in the users’ browser.

Web Server can be configured to take the users directly to my Login.aspx page when they type in the URL of the website, but I noticed that if the users want, then they can directly go to Profile.aspx and Preferences.aspx, something which I do not want to happen.

How to overcome this problem (assuming your Log-in and Log-out components are implemented correctly). The following piece of code is in C# (c sharp).

In the        Page_Load(object sender, EventArgs e)        method in C Sharp Code file associated with your ASPX page, embed your entire logic (code) in the following IF Condition:

            if (Request.IsAuthenticated)    //checking if the user trying to access the page is authorized

{
       //your entire Page_Load ( …. ) logic goes here in this IF condition
}

else

{             
                       Response.Redirect(“login.aspx”) ;     //This will take the user to your Login page
             }

If the user is not authenticated, not authorized, then the user will be taken to your default Login.aspx page to enter username/password before accessing any other pages of the application. The “else” condition in the above code snippet is responsible for taking the user to youlogin page, login.aspx