i have a question about security of pages

[miladhatam]

what is the best security way to access a private page
i use session
for example
if (Session.Contents["us"].ToString() != "admin")
{
Response.Redirect("default.aspx");

}
but i know it is not safe
can you help me ?

 

[Mark Fitzpatrick]

Forms authentication works nicely and is definitely a step above using
session variables. If you're using ASP.Net 2.0, you can use the built-in
membership system in combination with Forms authentication (in 1.x you would
have to write your own routine to validate user credentials). You can then
have a web.config for the protected sub-directory that essentially says to
deny all users who don't have an authentication ticket and then forms
authentication will automatically redirect them to a place to login (which
can be the default page if you just want to hide the admin login page).