Login security in ASP.net

[Steve C. Orr [MVP, MCSD]]

Dont' reinvent the wheel. Use the built-in Forms Authentication which
already provides this kind of functionality more gracefully than you are
doing it.
Here's more info:
http://www.dotnetbips.com/displayarticle.aspx?id=9
http://www.4guysfromrolla.com/webtech/121901-1.2.shtml
http://www.dotnetbips.com/displayarticle.aspx?id=117

 

[msnews.microsoft.com]

Exactly. You're doing it the old ASP way. Forms Auth is working great for
me.

-Max

 

[Pravin A. Sable]

Hello Everybody,

I have one login page and other pages which will be shown only if user
logs successfully. If someone tries to access page without
identification then she should be directed to login page.

I have following code

after successful login I do...
Session("UserID") = txtUser.Text.Trim()


In every page_load I have code...
Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load
curUser = CStr(Session("UserID"))
If Len(curUser) = 0 Then
Response.Redirect("./Default.aspx")
End If

End Sub

and in logout button I have...
Private Sub cmdLogout_Click(ByVal sender As System.Object, ByVal e
As System.EventArgs) Handles cmdLogout.Click
Session("UserID") = ""
Session("UserName") = ""
curUser = ""
Session.Abandon()
Response.Redirect("./Default.aspx")
End Sub


but it doesn't work. Even after logging out. Other pages can be accessed
straight. I don't know why. Can someone help me? Thanks in advance.

Regards,
Pravin