Security :: Formsauthentication Timeout And 2 Login Pages?
Jun 29, 2010
My client wants 2 separate login pages for an ASP.Net app, one for regular users, one for support staff. I am using the standard FormAuthentication component for authentication. Is it possible to redirect a regular user to one login page after a timeout, and also to redirect an admin user to a different page after a timeout? The loginUrl attribute of <forms> in web.config is read-only, and cannot be edited at runtime.
Regular User -> Timeout -> Login.aspx
Support User ->Timeout -> SupportLogin.aspx
View 1 Replies
Similar Messages:
Aug 9, 2010
I am using Forms Authentication in my VS-2005 website.In case of wrong credentials or while explicitly requesting protected pages the website is able to redirect user to login page. However, when correct login credentials are provided the application is not able to redirect the user to the desired page.While debugging I found that 'Request.IsAuthenticated=False' just before I redirect the user to the desired page.While coding I thought that this property will be set to true automatically after I generate the Authentication ticket. So do I need to set it explicitly inside the submit button click on Login page after validation?BTW I have not used the 'GetAuthcookie', 'SetAuthCookie' or 'RedirectFromLoginPage' methods.
I am posting the code inside the submit button click on the Login page as well as the Authentication and Authorization tags in web.config.
<authentication mode="Forms">
<forms name=".ASPXFORMSDEMO" loginUrl="~/Login.aspx" cookieless="UseCookies" path="~/"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
Protected Sub btnsubmit_click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btnsubmit.Click
'here first validate if the user is valid user
ad = New Aranya_Data
[code]....
View 1 Replies
Mar 16, 2010
What is the difference between:
FormsAuthentication.RedirectFromLoginPage
AND
FormsAuthentication.SetAuthCookie(Text_txtUserName.Text, true);
HttpContext.Current.Response.Redirect(RedirectFromLoginAddress);
View 3 Replies
Nov 22, 2010
i would like to redirect user to login page after defining session timeout
how to redirect the user to my login.aspx and how to set session time out within web.config
View 7 Replies
Dec 10, 2010
I have forms authentication for my application which uses aspnet_membership database. I want to further expand this to include recording the time in and time out fro keeping an attendence record of the users.
View 5 Replies
Feb 19, 2010
I'm trying to implement a 'remember me' functionality on my website to allow the users to remain logged in without having to login again.
ity.FormsAuthentication.SetAuthCookie(userName, true);
I've noticed that the 2nd parameter (createPersistentcookie) is not really persistent as it depends on the timeout value set in the config file.
View 3 Replies
Jun 23, 2010
i used security in login page which restricts all users who have not logged in to all pages. I need to restrict specific users to specific pages. I'm not using AspSqlService provider. So i cannot create roles and restrict automatically. And the pictures i use in login page are not visible @ runtime.
View 1 Replies
May 18, 2010
I have created 3 different folders (admin, user, viewer) in my site and each has a different template (masterPage). I created user and roles which are admins, users, and viewers. I assigned each role to a user in .Net administration Tool.
What I need to do is to allow each user to access his page only and deny access to others , except for the admin who can access all pages.
View 4 Replies
Nov 11, 2010
I'm using the following code which autheticates a user and redirect him to a members webpage. This works however if I access the protected page directly I bypass the security. Do I need a check in the OnLOAD for each page? My second question is how to say hello username on the members page. What variable can I reference to display the username?
[Code]....
View 5 Replies
Mar 17, 2010
I didn't really know where to post this so thought i'd postit where hopefully people understood the page cycle and what's going on when people perform logins.So I don't know if people have noticed before but Facebook uses an unencrypted page for login, albeit the page redirects to an encrypted page but that very first POST is clearly visible to everyone- I've looked using Tamper Data in Firefox.How is it they can get away with this, or am I missing something here? Have they decided that if people don't look after their own security then it's not their fault? I do't understand as eBay, Amazon etc all make you go to an SSL page to login, obviously because all request and post data is encrypted... Why can Facebook do away with this security measure? I don't understand.Just looking for some insight in being able to have login controls placed on unencrypted pages and then redirecting people to secure pages.. it still doesn't work out in my head though?
View 2 Replies
Oct 18, 2010
I want to create a website that a user can logon and view their data. They should also be able to logout. I'm wondering how to achieve this WITHOUT using the Membership provider api provided by Microsoft. This is what I think should happen.
1. user enters name and password and clicks button.
2.If username and password are correct the user is redirected to a webpage with their details.
3.A session is created.
4.The user logouts and the session is deleted.
View 10 Replies
Jun 24, 2010
I developed our feature rich web page which is constantly changing. I'm not much of a programmer but I know HTML and CSS pretty well. I have a need to create a couple of login page for prospects and end users to get to secured content. I put together a page that works perfectly in Microsoft Visual Web developer Express 2010. This includes a login page. Ironically, after learning how to do all this from a book, there is a web page that perfectly chronicles what I am trying to accomplish and the steps to do it. It's here: [URL]
I don't expect you to watch it, but there is a simple aspx page created for login and then users are created and the content is displayed after successful login. It works fine in m development environment, but when I post, nothing. Furthermore, twice in the last two days, after downloading my current site to my hard drive, and then posting back after adding this functionality, my FrontPage forms stopped working. I had to have my website restored from backup. The whole thing makes no sense and I can't find any precedence posted on any user forums. So any testing I do seems to wipe out my navigation structure.
I'm going to establish the site on a different server tonight and see if its configuration. If that works, I'm not sure where to g next. I'd appreciate any thoughts. The worst part is I can't post a test page or my Fropage contact forms stop working.
View 1 Replies
Mar 31, 2010
I have a website statistics program that creates .htm pages for viewing. Im trying to keep them in their own folder on the root - "Statistics"After reading many posts I have tried many iterations of:
[code]...
Problem is, an .aspx pages in there won't get served with login, but all the .htm pages will.
View 24 Replies
Mar 10, 2011
I have read the many posts of people trying to use two different login pages: one for users and one for admins. My question is very different. I have a Site.master page with a LoginView and LoginControl. I then have three root level pages Default.aspx, About.aspx, and Contact.aspx that derive from the Site.master. All three pages are set in the web.config to be allowed to all users. I then have a MemberPage in a Member folder which is only accessible to authenticated users. What I want to have happen is to be able to login from either the Default, About, or Contact pages and then be directed to the MemberPage.
View 2 Replies
Feb 16, 2011
I am using visual stuido 2010 and vb. I am trying to direct users to one of three different pages upon sign in, depending on their role. Basically I have three roles: administrators, dealers, and customers And three respective destination page urls: admin/default.aspx, dealer/default.aspx, and customers/default.aspx. Everything I can find in the forums is in C. So far I have nothing, so I guess I'm asking someone to write the whole sub for me. I wish I was more proficient, but I'm working on it.
View 4 Replies
May 24, 2010
i'm using the FormsAuthentication.RedirectFromLoginPage for the user login and for redirect to default.aspx page. I want that if a user called admin do the login is redirected to the page admin.aspx
View 3 Replies
Jan 26, 2011
Way to get FormsAuthenticationTicket after user logged in?
View 4 Replies
May 5, 2010
I have the following code in my secure/login.aspx page using .NET 3.5 and VB.NET
[Code]....
[Code]....
I read some articles that mentioned specifying the domain attribute within the <forms tag but that did not seem to work either. e.g.
View 4 Replies
Oct 13, 2010
Need the code for the login /logout in my sample project and how to attin logout in the all pages. dont mistake me as i am learning (fresher) the asp.net 2005
View 2 Replies
Oct 7, 2010
what is the use formsAuthentication.user.identity
is it one of the property of page
View 1 Replies
Apr 23, 2010
I have a login page that is set to the loginUrl property in the authentication section of my web.config file. I am trying to reference a CSS stylesheet, but it doesn't seem to be doing anything. Here is my markup:
[Code]....
I am able to do this just fine on my other page. One thing I noticed was when I click on "View Source" and try to click the link to the stylesheet, it doesn't take me there, and instead changes the "action" property of the form element to this:
[Code]....
View 2 Replies
Dec 1, 2010
Just a quick question i've been asked to look at enhancing security but encrypting passwords we store in a db table, essentially the data thats linked to the user account isnt sensitive however its more to stop someone reading passwords out of the table directly etc
I've read multiple ways of implimenting hashing etc i've started using FormsAuthentication.HashPasswordForStoringInConfigFile
//create new salt and update the password
Hashtable newInfo = new Hashtable();
newInfo["salt"] = GenerateFriendlyPassword(5);
string tmppass = FormsAuthentication.HashPasswordForStoringInConfigFile(txtNewPass1.Text.ToString() + newInfo["salt"].ToString(), "SHA1");
newInfo["passwordHash"] = tmppass;
Generate friendly password returns a 5 char string based on a random position in a valid char array containing a - z and 0 - 9At present the functionality is at page level in the code behind, re this is the forms authentication HashPasswordForStoringInConfigFile function thread safe? Or do i need to look at implimenting this in a different wayCheers appreciate your response as im always jubious about multi threading etc,
View 1 Replies
Jan 8, 2010
In my account controller I am calling FormsAuthentication.SetAuthCookie( emailAddress, rememberMe ).
Response.Cookies has my cookie. However, after the redirect the cookie is gone and the request is not authenticated.
View 6 Replies
Nov 6, 2010
We have a windows 2003 webserver which hosts .NET applications. Since last Microsoft security updates formsauthentication on all websites works only on non IE browsers? Before the update we experienced no problems.
View 2 Replies
Jan 21, 2010
I've set up a system with forms based authentication and using the asp:Login control. When I put in an invalid password I get the approriate invalid password message. However when I put in a valid password, it does nothing...just returns to the login page again. I'm triple checked the login info. There is no error message, and the invalid attempts counter doesn't increment. When I put a break point in the Login_LoggedIn event of the Login form, it hits it, but User.Identity.IsAuthenticated is false. I'm not 100% sure it should be true at this point, as I'm pretty new to .NET but it seems kind of odd.
My user database is stored in a sqlserver 2005 db that already existed. I've added a new connection for it.In the authorization I have
<authorization>deny
users="?"/><authorization>
View 2 Replies
