How do I prevent URL entry and redirect the user to login page?

Question

I am using forms authentication on ASP.NET. If I try to access a page by copying the query string and pasting it into the browser, it allows me access to the page.

How can this be prevented? I want the user to always have to login.

Answer 1

You could restrict access to certain pages by using the <location> element. So for example to restrict access to the sub-folder admin:

<system.web>
    <!-- enable Forms authentication -->
    <authentication mode="Forms">
        <forms 
            name="MyAuth" 
            loginUrl="login.aspx" 
            protection="All" 
            path="/" 
        />
    </authentication>
</system.web>

<!-- restrict access to the admin subfolder 
     and allow only authenticated users -->
<location path="admin">
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</location>

Answer 2

You have to set the authentication mode in your web.config

  <authentication mode="Forms">
        <forms name="Authen" protection="All" timeout="60" loginUrl="login.aspx"/>
    </authentication>
<authorization>
    <deny users="?"/>
</authorization>

Answer 3

You should add something similar in the web.config file:

<authorization>
    <allow users="user1, user2"/>
    <deny users=”?”/>
</authorization>

That should fix the problem. See: http://support.microsoft.com/kb/815151

Answer 4

You could specify the loginUrl to redirect unauthenticated users

e.g.

<authentication mode="Forms">
  <forms loginUrl="member_login.aspx"
    defaultUrl="index.aspx" />
</authentication>

Update However once authenticated the users can paste urls into their browser and there will be no redirection. If you want to stop this type of behavior you'll need to do something else. That something else would depend on how your site is designed.

Answer 5

Apart from configuring authentication in the web.config file, you can also use the Global.asax Session_Start(...) method to check for users new session, also be sure you revise the session cookie, if it is null you should redirect the user to the login page:

public class Global:System.Web.HttpApplication 
{
    protected void Session_Start(object sender, EventArgs e) 
    {
        if(Session.IsNewSession) 
        {
            if (Request.Headers["Cookie"] != null) 
            {
                if (Request.Headers["Cookie"].IndexOf("Web_App_Login_Cookie", StringComparison.OrdinalIgnoreCase) >= 0)
                {
                    FormsAuthentication.SignOut();
                    Context.User = null;
                    Response.Redirect("~/logOn.aspx");
                }
            }
        }
    }
}

Also, if you store user session information in some class you can override the OnInit(...) method in some base class to ensure the user already exists in some custom session collection, if not once again you should redirect to login Page.

public class SessionBasePage : System.Web.UI.Page
{
    protected override void OnInit(EventArgs e)
    {
        base.OnInit(e);
        if (HttpContext.Current != null && HttpContext.Current.Session != null)            
        {
            UserSession = HttpContext.Current.GetUserSession();
            if (UserSession != null)
            {
                LoggedUserInfo = HttpContext.Current.GetLoggedUserInfo();
                HttpContext.Current.UpdateLoggedUserInfo();
            }
            else { Response.Redirect("~/logOn.aspx", true); }
        }
    }
}