Jonathan Crossland
Posts: 630
Nickname: jonathanc
Registered: Feb, 2004
|
Jonathan Crossland is a software architect for Lucid Ocean Ltd
|
|
|
|
Deny Users
|
Posted: Apr 23, 2004 6:19 PM
|
|
|
This post originated from an RSS feed registered with .NET Buzz
by Jonathan Crossland.
|
Original Post: Deny Users
Feed Title: Jonathan Crossland Weblog
Feed URL: http://www.jonathancrossland.com/syndication.axd
Feed Description: Design, Frameworks, Patterns and Idioms
|
Latest .NET Buzz Posts
Latest .NET Buzz Posts by Jonathan Crossland
Latest Posts From Jonathan Crossland Weblog
|
|
This refers to using the Authorization functionality with ASP.NET Forms Authentication.
deny users
When you use the web.config and Forms Authentication, you can deny a user access to a page unless they are logged in.
typically your web.config would contain something like this:
<location path="MyWebForm.aspx">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
If you would like to deny access to a UserControl, you will find that it cannot. You cannot specify certain characters including the ? in the <location path="">
As it happens, my current project's code, included a MasterPage: Page
and a MasterUserControl : UserControl
Basically I derive all my Pages and UserControls from these, as they contain some general code that I want to apply to all.
The MasterPage looks at Request["View"] to get the UserControl to load. So typically I have one main aspx page.
Within this framework, I needed UserControls that are Public and those that are secure with Forms Authentication.
To do this, I created this code:
public class SecureUserControl : System.Web.UI.UserControl
{
private void Page_Load(object sender, System.EventArgs e)
{
if (this.Page.User.Identity.Name=="")
{
Server.Transfer("default.aspx?View=Login&RETURNURL="+Server.UrlPathEncode(Request.RawUrl));
}
}
}
Those UserControls that I wish to be Secure behind the Forms Authentication, I derive them from SecureUserControl.
In order to inform the Authentication methods the URL I was intended to go to before redirecting to the login is specified in the RETURNURL section of the querystring.
Read: Deny Users
|
|
Previous Topic
