CodeProject: Protecting pages with include files. Free source code and programming help

Announcements

	Windows 7 Comp Win a laptop!
	Monthly Competition

Articles

Desktop Development

Web Development

Enterprise Systems

Content Management Server

Microsoft BizTalk Server

SQL Reporting Services

Platforms, Frameworks & Libraries

Windows Communication Foundation

Windows Presentation Foundation

Windows Workflow Foundation

Cryptography & Security

Threads, Processes & IPC

WinHelp / HTMLHelp

Uncategorised Quick Answers

Graphics / Design

Expression

Usability

Development Lifecycle

Debug Tips

Design and Architecture

Uncategorised Technical Blogs

Services

Code-signing Certificates

Job Board

CodeProject VS2008 Addin

Feature Zones

Product Showcase

Code Signing Resources

WhitePapers / Webcasts

ASP.NET Web Hosting

Advanced Search
Add to IE Search

Discuss

Report

12 votes for this article.

Popularity: 3.96 Rating: 3.67 out of 5

Download source files - 3 Kb

Introduction

In this article I will show you how to authenticate users so as to protect pages from being seen without permission. It uses a set of ASP files that will be included to each page that needs protection.

In the example the authetication occurs with a couple of StrComp comparsions, but in real world it should be done using a table or a COM component.

These are the necessary asp files with a explanation of its use:

Login.asp	This file ask for the userID and password
LoginCheck.asp	This file checks if the userID and password are OK. If so it redirects to the correct page, otherwise it redirects to the Access Denied page
AcessDenied.asp	This is the file with the Access Denied message, nothing more
Pages.asp	To be able to redirect to the right page after the login I gave each page a unique identifier. So this file has the list of pages and it's identifier. The URL is retrieved from the function `GetURLFromNumber`
Protector.asp	This file must be included in each page that needs protection. Before its inclusion an identifier called nURLID must be declared with the value of the identifier for this page (see Pages.asp).

To see it working click here

More information about include files can be found typing "#include" on the Index page of MSDN.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

About the Author

xicoloko

Member

XicoLoko is a brazilian developer based in Switzerland.

Occupation:	Architect
Company:	VisionOne AG
Location:	Switzerland

Other popular ASP articles:

Universal Table Editor
Viewer and Editor for any table in any Database you can reach from your IIS/PWS.
bttlxeForum - Advanced ASP Forum Software
bttlxeForum is a freely available feature rich database-driven Internet forum solution written entirely in Active Server Pages.
Adding a search facility to your website
Using the Microsoft Index Server to enable your readers to search your site
The Code Project Discussion boards
The Discussion board ASP scripts as used in The Code Project. This is an open source project for the Code Project community.
Using a Wiki for knowledge sharing and SQL Server database documentation
This article describes using a Wiki for knowledge sharing and database schema documentation.

Article Top

You must Sign In to use this message board.

FAQ
Noise Tolerance Layout Per page

Msgs 1 to 18 of 18 (Total in Forum: 18) (Refresh)

FirstPrevNext

what should i do with my retrieve data from database

vannak

14:35 15 Jun '03

Dear Sir/Madame
I have a problem with my Query in Database
Ex: my table

PageId : Title : Page
1 struture <body>

this is my page using	href='printpage.asp?PageID=<%=oRS ("PageID")%>'><img src="print.jpg"> When i retrieve it to page by using <%=oRS("page")%> the query printpage.asp?PageID=1 it doesn't run. Anyone Can help me Thanks Vannak
Sign In·View Thread·PermaLink	5.00/5 (1 vote)

Missing pages.asp

Steve C

9:42 8 Jul '02

can you please send this to me?
Sign In·View Thread·PermaLink	1.50/5 (2 votes)

Re: Missing pages.asp

Emelian

2:46 19 Apr '03

You can find the missing page here: http://www.codeproject.com/asp/IncludeProtection/pages.asp Just open this link in your browser and save the page by 'File', 'Save As', then name it ("pages.asp"), without the parantheses, and hit Save -button.
Sign In·View Thread·PermaLink	3.00/5 (3 votes)

MISSING PAGES.ASP

Davebond

21:38 3 Jul '02

COULD YOU SEND ME THIS FILE PLEASE YOU LL SAFE ME
Sign In·View Thread·PermaLink

Pages.asp missing

mike2117

10:42 7 Jun '02

Please update the site and/or send me the pages.asp. Also, please fix the navigation problem.... mentioned in an earlier post
Sign In·View Thread·PermaLink

Pages.asp missing

Chris Hoskins

13:24 4 Oct '01

Your missing the pages.asp page. It's not included in the files you can download. Could I get this? Chris H.
Sign In·View Thread·PermaLink

lost navigation

Anonymous

6:41 25 Jan '01

In the version presented here, the user is lost when he does not know the userid/password. IMHO, you should always be able to get back to where you came from. Now, the Back arrow loops into the login screen again. Frans Verbaas
Sign In·View Thread·PermaLink

Two Comments

James Curran

8:59 23 Aug '00

First, the Pages.asp file is unnecessary. The name of the ASP page being executed is available via Request.ServerVariables("SCRIPT_NAME"). This can then be passed on the request line as ID is now, or stored in a session variable.

Also, it's probably not a good idea to store the password as a cookie. (security breach) It would be better create some unique code which the ASP page can read as "User is successfully loged on", but give no information about the actual password

Re: Two Comments

xicololoko

11:31 23 Aug '00

Your are right about the pages.asp. But if the user has cheched the remmember me check box I need to make the logon persistent. How would I know that the user has a valid username and password throught the cookie values? Thanks for your advice )
Sign In·View Thread·PermaLink	2.00/5 (1 vote)

Re: Two Comments

James Curran

18:52 23 Aug '00

Note that you have two separate checks for UserID & Password; one for the values entered into the form, and one for the cookies. Now, once the person has entered the correct values into the form, you can put anything into the cookie --- the only requirement is that it pass the *other* check, and somehow identify the user.

Let's say that the user information is being stored in a database, with a sequenial id, then we could mathematically altered that number so that it's not obvious (say multiply it by 234) and store that as a cookie. Then we can simply derived that actual ID number from the cookie, and easily spot a forged cookie, all without storing the password locally

Re: Two Comments

Tom Wellige

23:25 23 Aug '00

Hi,

on my sites I use the following login-mechanism: after verifying a valid user (userid, pwd) I put his current SessionID in a database. In this database I have informations about the user, his rights and all pages and page groups. When ever the user will open a new page my code checks if the user is logged in (his SessionID is in my database) and if this user has enough rights to see this page.

Well, this way needs also a cookie but this cookie will only include the SessionId, nothing else.

Well, actually I am currently writing on an article for the CodeProject explaing this in detail. Just give me some more time to finish it.

Tom.

Re: Two Comments

James Curran

11:56 24 Aug '00

When do you remove a sessionid from the database
Sign In·View Thread·PermaLink

Re: Two Comments

Uwe Keim

20:40 24 Aug '00

You could do this with on function you call from time to time that checks the last access and to the session (of course you have to store the last access-time in a db-field) and then deletes the entry if the last access-time is too old. Or you could write a task-sceduled script (vbs, pl, whatever) that does just the same. Or maybe you could use one of those events in `global.asa`
Sign In·View Thread·PermaLink

Re: Two Comments

Tom Wellige

22:01 24 Aug '00

James, - when the user manually logs out - as Uwe already wrote with a small script chicking if a user is timed out (this is a parameter in my db, also I put the "last access time" of a user into the db
Sign In·View Thread·PermaLink

Re: Two Comments

Claude Vedovini

8:18 28 Aug '00

I think you could just clean out your db using the Session_OnEnd event in the Global.asa file. That way, whether it was timed out by the server, or killed by calling Session.Abandon, the job would be don
Sign In·View Thread·PermaLink

Re: Two Comments

Tom Wellige

11:19 29 Aug '00

That's a good idea. Thanks for this hint
Sign In·View Thread·PermaLink

Re: Two Comments

karthik

8:25 18 Sep '00

Tom sent me this link about a login sytem as a reply to my question in the message board. I found it very useful. http://www.asptoday.com/articles/20000704.htm
Sign In·View Thread·PermaLink

Re: Two Comments

shabbir karim

0:59 26 Dec '02

its not safe to keep password s like this
Sign In·View Thread·PermaLink	2.00/5 (1 vote)

Last Visit: 22:21 21 Nov '09 Last Update: 22:21 21 Nov '09

General News Question Answer Joke Rant Admin

PermaLink | Privacy | Terms of Use
Last Updated: 14 Sep 2000
Editor: Chris Maunder