Secure pages and Web Site Administration Tool 2

[MaryNET]

Hi,
I need to have some secure pages that the user
has to log in to get access to.
I have .aspx pages in the root folder that will
contain the secure and non-secure pages.

I was looking at the ASP.NET 2.0 Web Site Administration Tool, but I'm not crazy about it.

Could anyone make any recommendations on how I should configure the secure pages?
Thank you

 

[larryman]

ASP.NET 2.0 Web Site Administration Tool is very easy to use and saves time.

Watching this video might be helpful

http://www.asp.net/learn/videos/video-45.aspx

Oysterbar ride to success. Keep Riding

 

[jmeckley]

use the authentication/authroziation and location config sections in the web.config file to secure the files.

it's much easier to place the secure pages in a sub directory and apply permissions to the directory. the alternative is listing out each secure page and it's allow/deny permissions.

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[MaryNET]

Thanks larry, jm. I liked the video.

The thing I don't like about the Web Site Administration Tool is that it uses a database (ASPNETDB.MDF) that is not part of the website's database. I know you can use your own SQL Server database, but I'm not sure of what nightmares that may cause.

If I was using this tool for customers placing an order and creating an account, how do I insert the correct data into the right database? How do I look up a customer later if their email info is one database and their order info in another?

Is this tool good to use in this situation?

 

[jmeckley]

if this is an enterprise level app then i would recommend implementing the security in 1 of 2 ways.

1. use a mvc approach to displaying web pages. either uing castle windsor, monorail, or ms mvc (.net 3.5 only). this approach is a radical depature from M$ webforms, but is ideal for large scale applications.

2. using traditional M$ asp.net webforms, role your own security model by implementing the appropiate security interfaces. david hayden has some posts on the subject:

http://davidhayden.com/blog/dave/ar...oleProviderASPNETRolePermissionsSecurity.aspx

http://davidhayden.com/blog/dave/ar...mMembershipProviderASPNETWebsiteSecurity.aspx

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[larryman]

You might want to use a single database instead of two, depending on the solution or the strategy you have adopted. I'm not aware of any nightmare this might cause but can give 100% guarantee. I have used this method in the past and it worked perfectly for me.

You might want to explore jm's method and select the one that's most convenient for you.

Oysterbar ride to success. Keep Riding