Problem with Sessions 1

[Rexolio]

I'm using a session for a secure area of my site. If the user logs in with the correct password, the session

PASSWORD PROCESS ASP***************************************
if Password = "test56" then
Session("authorized&quot = 1
Response.redirect ("main.asp?UID=" & UserID & "&quot
else
Session("authorized&quot = 0
Response.redirect ("entry.asp?ErMsg=Incorrect~Password&quot
end if

PROTECTED PAGE ********************************************
if Session(&quot;authorized&quot <> 1 then
Response.redirect (&quot;entry.asp?ErMsg=Session~Timeout&quot
end if

I now see the need to tighten up my security. As it is, the User ID gives users their account information. However, once in the protected area, you can easily change the UID in the address field on the browser to be a different number, and if that number is a valid UID, then someone else's account info displays.

I've tried doing the following:

PASSWORD PROCESS ASP***************************************
if Password = &quot;test56&quot; then
Session(&quot;authorized&quot = UID
Response.redirect (&quot;main.asp?UID=&quot; & UserID & &quot;&quot
else
Session(&quot;authorized&quot = 0
Response.redirect (&quot;entry.asp?ErMsg=Incorrect~Password&quot
end if

PROTECTED PAGE ********************************************
if Session(&quot;authorized&quot <> UID then
Response.redirect (&quot;entry.asp?ErMsg=Session~Timeout&quot
end if

However, everytime I try to login in I get thrown back to the entry.asp page with the message &quot;Session Timeout&quot;. I figured this would work after the login page because if a user changes the UID number, the session value would still be the original UID, therefore when the changed UID didn't match it would throw them back to the sign in page.

Can anyone help?

Thanks!
Rexolio

 

[derren]

Hi

Just a quick question - in the protected page you are checking the session against a variable called UID, have you already established the value of that variable using something like:

UID = Request.querystring(&quot;UID&quot

If you haven't that'll be your problem, you are assuming that the querystring parameter is already been picked up by the VBScript. Derren
[The only person in the world to like Word]

 

[Rexolio]

sorry to leave that out, but yes, I have identified the value...

UID = Request(&quot;UID&quot

Thanks,
Rex

 

[derren]

Hmm, everything looks OK from here, there may be something else which is playing a part.

Before the UID check in the protected page, pop some varible listing code in to manually check those values.

response.write(&quot;Session is: &quot; & session(&quot;authorized&quot & &quot; URL parameter is: &quot; & UID)
response.end

This will narrow down the search a lot. Derren
[The only person in the world to like Word]

 

[Ovatvvon]

For the security, why don't you just make the UserID in the session scope instead of passing it from page to page? This increases your security because you don't need to worry about someone changing the number in the url bar, plus it is automatically carried over to every page without you having to specify it.

Then, you can also simply check for a true or false value on the session(&quot;authorized&quot variable for each page as well which will make for less confusion. -Ovatvvon :-Q

 

[Rexolio]

Ovatvvon,

I know what you're saying and I think I tried to do that earlier with the same results, but could you give me an example?

Rex

 

[Ovatvvon]

--- Signin Page ------------
If password = &quot;asdf&quot; Then 'Case-Sensitive if straight text
session(&quot;authorized&quot = True
session(&quot;uid&quot = UserID
response.redirect(&quot;main.asp&quot
Else
session(&quot;authorized&quot = False
session(&quot;uid&quot = 0
response.redirect(&quot;entry.asp?Errmsg=&quot; & Server.URLEncode(&quot;Incorrect Password&quot)
End If


--- Main Page ---------------------------
If session(&quot;authorized&quot <> True Then
Response.redirect(&quot;entry.asp?Errmsg=&quot; & Server.URLEncode(&quot;Session Timeout&quot)
End If


Now the user's ID is not being passed via URL, and therefore cannot be altered.

Hope this makes sense... -Ovatvvon :-Q

 

[Rexolio]

Ovatvvon... Thanks! That works like a charm!!! Its perfect!!! Thanks again!