在Web登录系统中如何阻止网页阻止未经授权的用户？

Question

In login register system users who do not know their passwords should have no ability to open some pages and to watch other users profile pages. They are allowed to enter only several certain pages. How pages are blocked against unauthorized users in web login system?

Edit: I do not mean a way to decide if user would be redirect to any page but how some certain pages are blocked. Imagine that somebody enters the site directly not via login page.

Answer 1

In very simplistic terms, while leaving out a lot:

Your server must give each user a cookie containing a random unique number by which they can be identified.

Then when a user has successfully logged in, this number will be stored in the database record that belong to that user.

So every time a restricted page is accessed, the number inside the cookie is offered up by the client and compared, by the server, against the number in the database. If it matched the page can be accessed as that user.