ASP.NET重定向到默认URL以外的页面

Question

I was able to redirect the user to the default url(Default.aspx) page after every successful login. Now i want to make sure that the staff who is not an administrator to try to access login(Unauthorized.aspx) into default page. I'm using two asp.net page(Default.apsx and Unauthorized.aspx). But the problem is when i use mary tan who is administrator redirect to another page(Unauthorized.apsx) instead going to default url page. Here is my error:

Staff and Admin:

click image

Output:

view output

Web.config:

  <authentication mode="Forms">
      <forms loginUrl="~/Login.aspx" defaultUrl="~/Default.aspx" slidingExpiration="true" timeout="20"></forms>
    </authentication>

Login.aspx.cs coding:

public partial class Login : System.Web.UI.Page
    {
        SqlConnection conn = null;
        SqlCommand cmd = null;
        string connectionString = null;
        string staffName = null;
        string staffId = null;
        string role = null;
        protected void Page_Load(object sender, EventArgs e)
        {

        }

        public bool CheckValidUser(string Username, string Password)
        {
            bool valid = false;
            SqlDataReader dr = null;

            connectionString = ConfigurationManager.ConnectionStrings["LeaveManagementCS"].ConnectionString;

            string sql = "SELECT * from Staff WHERE Username=@Username AND Password=@Pwd And Role=N'A' OR Role=N'S'";

            try
            {
                conn = new SqlConnection(connectionString);

                cmd = new SqlCommand(sql, conn);

                cmd.Parameters.AddWithValue("@Username", Username);
                cmd.Parameters.AddWithValue("@Pwd", Password);

                conn.Open();

                dr = cmd.ExecuteReader();

                if (dr.Read())
                {
                    staffName = dr["StaffName"].ToString();
                    staffId = dr["StaffId"].ToString();
                    role = dr["Role"].ToString();

                    valid = true;
                }
                else
                {
                    lblOutput.Text = "There is an error logging in. Please check username or password.";
                }
                dr.Close();
            }
            catch (Exception ex)
            {
                lblOutput.Text = "Error Message: " + ex.Message;
            }
            finally
            {
                if (conn != null)
                    conn.Close();
            }
            return valid;
        }

        protected void tbLogin_Click(object sender, EventArgs e)
        {
            bool validUser = CheckValidUser(tbUsername.Text, tbPassword.Text);

            if (validUser)
            {
                Session["StaffName"] = staffName;
                FormsAuthentication.SetAuthCookie(staffName, false);
                FormsAuthentication.RedirectFromLoginPage(staffName, false);

                Session["StaffId"] = staffId;
                FormsAuthentication.SetAuthCookie(staffId, false);
                FormsAuthentication.RedirectFromLoginPage(staffId, false);

                Session["Role"] = role;
                FormsAuthentication.SetAuthCookie(role, true);
                Response.Redirect("~/Unauthorized.aspx");

            }
            else
            {

                lblOutput.Text = "Invalid User. Please try again.";
            }
        }
    }

Answer 1

The problem is during your login code, you are always redirecting valid users to the Unauthorized page

Response.Redirect("~/Unauthorized.aspx");

I'd just throw in a if statement here to redirect to the correct page if the user is in a certain role (and make sure that page is locked down using the ASP.NET Identity Roles system )