如何通过在浏览器中手动键入aspx文件名来防止访问Web表单？

Question

I have created a Login page that is only for admins (so there is no need to check if the user is admin or not). The page does the check against a database where the username and password is stored. I am able to successfully check the name/password against the database and then transfer the user to the admin page, however, I noticed that I can still type http://localhost:xxxxx/AdminPage and it will take me there. How do I stop people from doing this? I have tried adding

<authorization><deny users="?"/></authorization> 

to the web.config file, which stops all anonymous users from entering, but now I need to know how to allow users from the database to be given permission. (NOTE: this is not a normal Login to Default setup. This is directing to a page other than Default)

Answer 1

You can user role based authorization described here . If you use default ASP role system, you need to add some code to web.config:

<location path="your_page"  >
    <system.web>
      <authorization>
        <deny users="?"/>
        <allow roles="Admin"/>            
      </authorization>
    </system.web>
  </location>