session variables

[JohannIcon]

Hello All,

I have a problem with the session variables. I set a session varaible in the login page and everything is working fine. However, when the user presses the back button on the Internet Explorer toolbar, he can access the admin.asp page without the need to login. Can I set something so that when the user presses the back button on the Internet Explorer toolbar, he does not have access to the admin.asp page?

Thanks for your help and time

 

[Targol]

Well, in your "login.asp", set a session variable that says if the currently logged user is an admin or not :

session("IsAdmin") = "true" 'or false depending on the profile.

Then in your Admin.asp page, add the following lines at the top :

<%
dim isAdmin
isAdmin=session(&quot;IsAdmin&quot;)
if isAdmin <> &quot;true&quot; then
   response.redirect(&quot;notAllowed.asp&quot;)
end if
%>

where "notAllowed.asp" is a single page showing an error message. Water is not bad as soon as it stays out human body ;-)

 

[JohannIcon]

Yeah that is working fine. The only problem is with Internet Explorer Back button. I do not know if it is a common problem and if there is anything to do about it.

 

[Targol]

You mean that this code works fine in general but not in case of "back" button ?
Water is not bad as soon as it stays out human body ;-)

 

[JohannIcon]

Yeah, and by the back button, I mean the one there is on the Internet Explorer toolbar. I do not know if it is a common thing or else if it is my code.

 

[Targol]

In general, when user presses "back" button to reach an asp page, he's being told that "the page cannot be reached unless you send back informations" (or something like that, my IE is french version). Are you sure that the back button leads you to the good page ?
In all cases, my advice is to add the session variable verification :

<%
dim isAdmin
isAdmin=session(&quot;IsAdmin&quot;)
if isAdmin <> &quot;true&quot; then
   response.redirect(&quot;notAllowed.asp&quot;)
end if
%>

on ALL your pages to avoid problems. Water is not bad as soon as it stays out human body ;-)

 

[JohannIcon]

Ok thanks for your help, but I already included it in my asp page like this:-

<%
if not Session(&quot;Secure&quot then response.redirect(&quot;administration.asp&quot
%>

and this is in the beginning of the asp page. Infact when I try to access it directly, it does not allow me, which is fine