How do you make the user stay on a particular page of a website?

Question

So here is what i am trying to achieve

When a user logs in and his password has expired, i redirect him a change password screen. I would like the user to change his password prior to going to other links in a menu

I want to redirect back to this changepassword.aspx when ever he attempts to leave, unless he changes his password

So how do I do this? and more importantly where?

Thanks for the help!

EDIT: I know we can use response.redirect, but it cant be used in the Unload operation

EDIT: ok i am not asking this right, i need help in keeping the user on the page - how do i do that and which part of the page [load, unload, etc]

Answer 1

Set a flag in the user's session indicating that they need to change their password, then check that flag from all your other pages and redirect them to the change-password page if necessary.

Answer 2

Please don't do that. That kind of PITA UI is very irritating. Just expire their password and then fail their access if they don't change it.

Don't treat your users like children (unless they really are children and maybe not even then)

Edit: Made this a Community answer, as I'm just preaching not answering ;-)

Answer 3

1. Set a session var if they need to change their password
2. On every pageload check for that session and if it exists (and they're not on the password change screen), redirect.

Answer 4

I'd set a variable in his session, then in your Global.asax Application_BeginRequest event check for the Session variable and redirect if needed.

Answer 5

Explained: Forms Authentication in ASP.NET 2.0

"This module explains how forms authentication works in ASP.NET version 2.0. It explains how IIS and ASP.NET authentication work together, and it explains the role and operation of the FormsAuthenticationModule class."

In the web.config, I have the authorization section saying

<authorization>
  <deny users="?"/>
  <allow users="*"/>
</authorization>


<location path="ChangePassword.aspx">
  <system.web>
    <authorization>
      <allow users="*"/>
    </authorization>
  </system.web>
</location>

Answer 6

We used to use a masterpage on our site and in the Page_Load event of that, we redirect the user to our changepassword.aspx page.

We also used (or abused, depending on your viewpoint) the Profile element of asp.net membership and simply set a MustChangePassword entry to true in it. It means that when they log-in, you can see if the MustChangePassword entry is set in their profile and redirect to the change password page. It certainly keeps them on the page.

People are right to suggest that sticking it in every page load is silly but the overhead is tiny to check one element in the users profile and you at least can force currently logged in users to change their password.