如果未使用 C# 登录 ASP.NET Web 表单，则将用户重定向到登录

Question

I'm trying to develop web app in ASP.NET web forms using C# and I've looked everywhere I could on the internet, but I found no solution to the problem. I've tried editing the default Web app template, to restrict a user from accessing any page if the user is not logged in. The default page should be the log in page and if the user clicks on anything else, he/she must be redirected to login page. Using MVC is easier, with just one bit of code on web.config but I've no idea what to do here in the web form

This is currently what my web.config contains.

<?xml version="1.0"?>
<configuration>

  <location path="Manage.aspx">
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
  </location>

</configuration>

Where exactly I need to change?

Answer 1

The shortest path to what you want is to use forms authentication with a login URL , where you'd add something like this to your web.config:

<authentication mode="Forms">   
    <forms loginUrl="login.aspx" />
</authentication>

The forms authentication mechanism will issue a cookie to a user when they log in. If they attempt to access a page without the cookie, or with a cookie that has expired, the site will detect this via the FormsAuthenticationModule , which inspects each and every request that hits the site. If the user isn't authenticated, it'll automatically issue a redirect to the loginUrl that you have specified (login.aspx in my example).

You can use a similar approach if you are using other authentication methods. In pretty much all cases there will be some mechanism that looks for a cookie indicating that the user has signed on.

Answer 2

Mmm....okay lets do it by another way, First on the login page, in code behind (The C# code not the HTML) you must create a session like this

Session["user"] = username;

you must create the Session before redirect the user to any page on your website , Now you created the session with the username or the email whatever you like to store in the session, You must check for the session in every page on your website in the Page_Load method in code behind to check for the session you do it like this

protected void Page_Load(object sender, EventArgs e)
        {
            if (Session["user"] == null)
                Response.Redirect("login.aspx", true); 
        }

where the "login.aspx" is the page in your website that the user will redirected to so, Now if Session["user"] is null the server will go to login.aspx with "just one bit of code" and to clear the session on the logout button you do it like

                Session.Clear();
                Session.Abandon();
                Session.RemoveAll();