Securtiy While navigation in ASP.NET

Question

I have given the particular permission for the particular user. Only that menu will be enabled which permission is set for that user.

I have two problems....

1) Menu item should be invisible rather than disable

2) If any User copy the page name which it has no access and can open it..

Suggest any....(urgent)

Answer 1

you can add this in the page load

if (!HttpContext.Current.User.IsInRole("YourRole"))
        {
            Response.Redirect("~/AccessDenied.aspx");
        }

Answer 2

You should look into the <location> element in <system.web> section of web.config. There you can set access rules as simple as

<authorization>
    <allow roles="Admin" /> <!--allows access to admins-->
    <deny users="*" /> <!-- denies access to any other users -->
</authorization>

More info here

Answer 3

you can manage the menu security by using ASP.NET Site-Map Security Trimming but if you want to prevent the uses from accessing the page through the url you can use put it inro your web.config file like:

<location path="securedAdministrationPage.aspx">
  <system.web>
    <authorization>
      <deny users="*" />
      <allow users="*" roles="Admins"/>
    </authorization>
  </system.web>
</location>

this link will help you http://wiki.asp.net/page.aspx/653/aspnet-webconfig--location-and-authroization-tags/

Answer 4

I would suggest putting your navigation into an user control and then use a switch statement or such, as well as the location section in the webconfig.

In the switch statement you can then use the 'Visible' attributes to hide the nav links (make sure they have a runat="server") from the users who do not have permission to view certain pages, dependant on their role (if using asp.net membership)