forms authentication

[JohnBeton]

Hi everyone,

I have a problem with forms authentication. It seems to be a problem that occurs a lot (found a lot of people on forums with the same problem) but i can't find a descent solution.

The thing is that when an unauthenticated user wants to access a secured page, he gets transferred to the loginpage.
There he can enter his credentials, after pressing the loginButton the application looks up his id and password in a database. A valid login fires the FormsAuthentication.RedirectFromLoginPage method.
But then it goes wrong: instead of going to the secured page, he returns to the login-page again.

What am i doing wrong ? any help is appreciated

 

[ca8msm]

I can't really say what you are doing wrong (you may be able to tell by stepping through your code) but here's an MSDN article that you can follow to make sure you have coded the various steps correctly:

http://msdn.microsoft.com/library/d...mwebsecurityformsauthenticationclasstopic.asp

--------------------------------------------------------------------------------------------------------------------------------------------

Need help finding an answer?

Try the search facility (

http://www.tek-tips.com/search.cfm)

or read FAQ222-2244 on how to get better results.

 

[JohnBeton]

my code:

web.config file from the secured webpage (location: schippers/nl/index.aspx):

<authentication mode="Forms" > 
  <forms loginUrl="[URL unfurl="true"]http://localhost/schippers/webLogin/schippersLogin.aspx">[/URL]
  </forms>
</authentication>

<authorization>
        <deny users="?" /> 
</authorization>

loginpage code (location: schippers/webLogin/schippersLogin.aspx)

Private Sub btnLogin_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogin.Click
        If checkUser(txtUser.Text, txtPass.Text, cn) Then
            FormsAuthentication.RedirectFromLoginPage(txtUser.Text, chkRemember.Checked)
        Else
            lblErr.Text = "Invalid username and/or password."
            txtUser.Text = String.Empty
            txtPass.Text = String.Empty
        End If
    End Sub

    Private Function checkUser(ByVal name As String, ByVal pwd As String, ByVal cn As OleDbConnection) As Boolean
        Dim myReader As OleDbDataReader
        Dim myCommand As OleDbCommand = New OleDbCommand("SELECT * from tblUsers where usrID = '" & name & "' and usrPassword = '" & pwd & "'", cn)

        Try
            If (Not cn.State.Equals(ConnectionState.Open)) Then
                cn.Open()
            End If
            myReader = myCommand.ExecuteReader()
            If myReader.HasRows Then
                checkUser = True
            Else
                checkUser = False
            End If
        Catch ex As Exception
            lblErr.Text = ex.Message
            checkUser = False
        Finally
            If (cn.State.Equals(ConnectionState.Open)) Then
                cn.Close()
            End If
        End Try
    End Function

It's the 'RedirectFromLoginPage'-method that fails, the rest of the code is going fine.
Hope you can help me with this...

 

[sirjon]

Hi,

Shouldn't your web.config read like so:

<system.web>


<!-- Other stuff -->
<compilation defaultLanguage="vb" debug="false" />
<customErrors mode="Off" />

<!-- Forms auth -->
<authentication mode="Forms">
<forms name="PWAuth" loginUrl="YourloginPage.aspx" timeout="60" protection="All" path="/" />
</authentication>

</system.web>

<location path="schippersLogin.aspx">
<system.web>
<authorization>
<deny users="?"/>
</authorization>

</configuration>

hth
j

----------------------------------------------------------------------------------------

http://www.whatsthehampton.com/

 

[JohnBeton]

hmm, I'm not sure...

I got the web.config from the microsoft tutorial on this matter.

By adding the location element:
<location path="schippersLogin.aspx">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
Doesn't that mean that unauthorized users can NOT acces the schipperslogin.aspx page ?

 

[sirjon]

Sorry yes,

The location is an area where you can put the pages you wish to protect.

<system.web>


<!-- Other stuff -->
<compilation defaultLanguage="vb" debug="false" />
<customErrors mode="Off" />

<!-- Forms auth -->
<authentication mode="Forms">
<forms name="PWAuth" loginUrl="schipperslogin.aspx" timeout="60" protection="All" path="/" />
</authentication>

</system.web>

<location path="ThePageToProtect.aspx">
<system.web>
<authorization>
<deny users="?"/>
</authorization>

</configuration>



----------------------------------------------------------------------------------------

http://www.whatsthehampton.com/

 

[JohnBeton]

ic...
But what's the difference between using the location-area or just put the:
<authorization>
<deny users="?" />
</authorization>
in the web.config of the 'pageToProtect.aspx' ?