check to see if a session variable is valid (enduser loged in)

[specialist]

Hello!
A very easy answer, but...
I really have been beating my head against the wall trying to figure this out but for the life of me i cannot!

Here is the deal:

I have an intranet application which requires endusers to login with their username and password. the username and pword are session variables defined in a form then being checked against a table in a sql2k db. Fair enough, I have that working fine! One point for me.
HOWEVER

I would like to check for the username and password variables if the enduser clicks on the link w/o going thru the form. For example -- if the end user had the page bookmarked, I would like the enduser to be re-directed to the login page if the username and password variables are not there. OR, if someone does not have a user/pass and is not allowed in there, I do not want them to be able to type the full URL and access the page.

VERY EASY for YOU, but not for me.

Please help if you can, thank you...

Mike

 

[myatia]

Add this code to all pages you want secured:

<%
IF (isEmpty(Session("Username") OR isEmpty(Session("Password")) THEN
   Response.redirect("login_page.asp")
END IF
%>

This will see if the session variables are empty, and then redirect to your login page ("login_page.asp" in this example)if they're not set.

As an added bonus, I would "remember" the URL the user was trying to access in the login form, so you can redirect the user to it once they've successfully logged in. You can do this with a hidden variable in the login form:

<input type="hidden" name="Referrer" value="<%=Request.ServerVariables("HTTP_REFERER")%>">

After that, check for a successful login and redirect back to the original URL with:

Response.Redirect(Request.Form("Referrer"))

Misty

 

[Sheco]

Also you can put the script that you want to include on ever page into an INCLUDE file. That way, if the script ever changes, you only have to change it in one place.