Securing a website

[emozley]

Hi,

Does anyone have a good example of how to secure a website with classic asp?

At the moment I have 3 pages:

loginform.asp, login.asp and welcome.asp

loginform.asp is a basic html form with username and password boxes.

login.asp loops through my username and password table and if it finds a row where the username and password are the same as the form submitted then I Response.Redirect("welcome.asp")

The problem at the moment is there is nothing to stop someone typing in

http://mywebserver/welcome.asp

and viewing the page thereby circumventing the login process.

I've got a feeling it's something to do with session variables but don't really know where to start looking.

Thanks very much

Ed

 

[Sheco]

Assign a session variable after you validate the username/password pair but BEFORE you do the redirect.

Session("UID") = [i]<username>[/i]
Response.Redirect "welcome.asp"

Then, on your welcome page, add something like:

... code to validate username/password goes here ...

If Session("UID") = "" Then
  Response.Redirect "loginform.asp"
End If

You can put that little bit of code on top of every ASP in your application and then anyone who is not logged in will be kicked out.

 

[Sheco]

whoops I did that backwards

[red]
This is the login page
... code to validate username/password goes here ...[/red]

Session("UID") = <username>
Response.Redirect "welcome.asp"

[red] ... this is the top of the welcome page ...[/red]
If Session("UID") = "" Then
  Response.Redirect "loginform.asp"
End If