Protecting pages with include files

Download source files - 3 Kb

Introduction

In this article I will show you how to authenticate users so as to protect pages from being seen without permission. It uses a set of ASP files that will be included to each page that needs protection.

In the example the authetication occurs with a couple of StrComp comparsions, but in real world it should be done using a table or a COM component.

These are the necessary asp files with a explanation of its use:

Login.asp	This file ask for the userID and password
LoginCheck.asp	This file checks if the userID and password are OK. If so it redirects to the correct page, otherwise it redirects to the Access Denied page
AcessDenied.asp	This is the file with the Access Denied message, nothing more
Pages.asp	To be able to redirect to the right page after the login I gave each page a unique identifier. So this file has the list of pages and it's identifier. The URL is retrieved from the function `GetURLFromNumber`
Protector.asp	This file must be included in each page that needs protection. Before its inclusion an identifier called nURLID must be declared with the value of the identifier for this page (see Pages.asp).

To see it working click here

More information about include files can be found typing "#include" on the Index page of MSDN.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

About the Author

xicoloko

Architect
VisionOne AG

Switzerland

Member

XicoLoko is a brazilian developer based in Switzerland.

Article Top

Poor

Excellent

Add a reason or comment to your vote: x
Votes of 3 or less require a comment

Comments and Discussions

You must Sign In to use this message board. (secure sign-in)

Search this forum
	Profile popups Noise Layout Per page

what should i do with my retrieve data from database

vannak

14:35 15 Jun '03

Dear Sir/Madame
I have a problem with my Query in Database
Ex: my table

PageId : Title : Page
1 struture <body>

this is my page using	<img src="print.jpg"> When i retrieve it to page by using <%=oRS("page")%> the query printpage.asp?PageID=1 it doesn't run. Anyone Can help me Thanks Vannak
Sign In·View Thread·Permalink	5.00/5 (1 vote)

Missing pages.asp

Steve C

9:42 8 Jul '02

can you please send this to me?
Sign In·View Thread·Permalink	1.50/5 (2 votes)

Re: Missing pages.asp

Emelian

2:46 19 Apr '03

You can find the missing page here: http://www.codeproject.com/asp/IncludeProtection/pages.asp Just open this link in your browser and save the page by 'File', 'Save As', then name it ("pages.asp"), without the parantheses, and hit Save -button.
Sign In·View Thread·Permalink	3.00/5 (3 votes)

MISSING PAGES.ASP

Davebond

21:38 3 Jul '02

COULD YOU SEND ME THIS FILE PLEASE YOU LL SAFE ME
Sign In·View Thread·Permalink

Pages.asp missing

mike2117

10:42 7 Jun '02

Please update the site and/or send me the pages.asp. Also, please fix the navigation problem.... mentioned in an earlier post
Sign In·View Thread·Permalink

Pages.asp missing

Chris Hoskins

13:24 4 Oct '01

Your missing the pages.asp page. It's not included in the files you can download. Could I get this? Chris H.
Sign In·View Thread·Permalink

lost navigation

Anonymous

6:41 25 Jan '01

In the version presented here, the user is lost when he does not know the userid/password. IMHO, you should always be able to get back to where you came from. Now, the Back arrow loops into the login screen again. Frans Verbaas
Sign In·View Thread·Permalink

Two Comments

James Curran

8:59 23 Aug '00

First, the Pages.asp file is unnecessary. The name of the ASP page being executed is available via Request.ServerVariables("SCRIPT_NAME"). This can then be passed on the request line as ID is now, or stored in a session variable.

Also, it's probably not a good idea to store the password as a cookie. (security breach) It would be better create some unique code which the ASP page can read as "User is successfully loged on", but give no information about the actual password

Re: Two Comments

xicololoko

11:31 23 Aug '00

Your are right about the pages.asp. But if the user has cheched the remmember me check box I need to make the logon persistent. How would I know that the user has a valid username and password throught the cookie values? Thanks for your advice )
Sign In·View Thread·Permalink	2.00/5 (1 vote)

Re: Two Comments

James Curran

18:52 23 Aug '00

Note that you have two separate checks for UserID & Password; one for the values entered into the form, and one for the cookies. Now, once the person has entered the correct values into the form, you can put anything into the cookie --- the only requirement is that it pass the *other* check, and somehow identify the user.

Let's say that the user information is being stored in a database, with a sequenial id, then we could mathematically altered that number so that it's not obvious (say multiply it by 234) and store that as a cookie. Then we can simply derived that actual ID number from the cookie, and easily spot a forged cookie, all without storing the password locally

Re: Two Comments

Tom Wellige

23:25 23 Aug '00

Hi,

on my sites I use the following login-mechanism: after verifying a valid user (userid, pwd) I put his current SessionID in a database. In this database I have informations about the user, his rights and all pages and page groups. When ever the user will open a new page my code checks if the user is logged in (his SessionID is in my database) and if this user has enough rights to see this page.

Well, this way needs also a cookie but this cookie will only include the SessionId, nothing else.

Well, actually I am currently writing on an article for the CodeProject explaing this in detail. Just give me some more time to finish it.

Tom.

Re: Two Comments

James Curran

11:56 24 Aug '00

When do you remove a sessionid from the database
Sign In·View Thread·Permalink

Re: Two Comments

Uwe Keim

20:40 24 Aug '00

You could do this with on function you call from time to time that checks the last access and to the session (of course you have to store the last access-time in a db-field) and then deletes the entry if the last access-time is too old. Or you could write a task-sceduled script (vbs, pl, whatever) that does just the same. Or maybe you could use one of those events in `global.asa`
Sign In·View Thread·Permalink

Re: Two Comments

Tom Wellige

22:01 24 Aug '00

James, - when the user manually logs out - as Uwe already wrote with a small script chicking if a user is timed out (this is a parameter in my db, also I put the "last access time" of a user into the db
Sign In·View Thread·Permalink

Re: Two Comments

Claude Vedovini

8:18 28 Aug '00

I think you could just clean out your db using the Session_OnEnd event in the Global.asa file. That way, whether it was timed out by the server, or killed by calling Session.Abandon, the job would be don
Sign In·View Thread·Permalink

Re: Two Comments

Tom Wellige

11:19 29 Aug '00

That's a good idea. Thanks for this hint
Sign In·View Thread·Permalink

Re: Two Comments

karthik

8:25 18 Sep '00

Tom sent me this link about a login sytem as a reply to my question in the message board. I found it very useful. http://www.asptoday.com/articles/20000704.htm
Sign In·View Thread·Permalink