重定向到自定义禁止页面在asp.net中不起作用

Question

I have a public (no authentication) website, except one page which requires authentication. That works fine.

The protected page is within a folder with the following web.config:

<?xml version="1.0"?>
<configuration>
    <system.web>
        <authorization>
            <allow roles="Warehouse" />
            <deny users="*" />
        </authorization>

        <customErrors mode="RemoteOnly" defaultRedirect="../WebForbidden.aspx">
            <!--<error statusCode="403" redirect="WebForbidden.aspx" />
            <error statusCode="404" redirect="FileNotFound.htm" />-->
        </customErrors>

    </system.web>
</configuration>

And the master file for that page has the following:

protected void Page_Init(object sender, EventArgs e)
    {
        CheckLogged();
    }

    public bool CheckLogged()
    {
        bool status = false;

        if (Session["Username"] == null)
        {
            FormsAuthentication.SignOut();
            Response.Redirect("../WebForbidden.aspx");
            //FormsAuthentication.RedirectToLoginPage();
        }
        else
        {
            status = true;
        }

        return status;
    }

And I have th WebForbidden.aspx page in the root of the website.

Now, everytime I try to enter directly to the protected page (which is forbidden unless authenticated) instead of showing the Forbidden page, an error is shown: The resource cannot be found , of course the website is trying to redirect to the Login page, which not exists.

Any help will be appreciated.

Answer 1

Try telling forms authentication to redirect to WebForbidden.aspx instead of letting it use the default, which if you don't specify it will look for Login.aspx

<system.web>
    <authentication mode="Forms">
        <forms loginUrl="WebForbidden.aspx" />
    </authentication>
</system.web>