ASP.NET membership password expiration

Question

I am using ASP.NET membership for the authentication of my web app. This worked great for me. I now have to now implement password expiration.

If the password has expired the user should be redirected to changepassword screen and should not be allowed access any other part of the application without changing the password.

There are many aspx pages. One solution could be to Redirect to Changepassword screen oninit of every aspx if the password has expired. Is there any other solutions or recommendations.

Thanks, Jai

Answer 1

Is this what you need?

Answer 2

You could add an event handler for the HttpApplication.PostAuthenticateRequest event in global.asax and handle the redirection there.

Answer 3

Thanks for your answers.I have now a base class from which I am deriving every Application Aspx page. I am now handling all the common tasks in the base class.

Thanks, Jai

Answer 4

Just implemented this in about an hour, no need to modify your base page. Heres what you have to do:

1) Respond to the LoggingIn event of the membership control
2) Find the user in the membership database and get LastPasswordChangedDate
3) Using a TimeSpan, compare this with the current date and decide if the password was last changed more than the requisite number of days ago. I get this value from web.config
4) If expired, redirect to the ChangePassword screen

Answer 5

Jai would you be willing to share? I am trying to do the same thing but I am having issues with it