Click here to Skip to main content
15,884,099 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Login Page =>

C#
protected void Page_Load(object sender, EventArgs e)
        {
            if (!Page.IsPostBack)
            {
                if (Session["UserId"] != null)
                {
                    Session.Clear();
                    Session.RemoveAll();
                    Session.Abandon();
                }
            }
          }
       

        protected void btnLogin_Click(object sender, EventArgs e)
        {
            string str1 = null;
            string[] UserName = null;
            try
            {
                if (txtusername.Text.Contains("@"))
                {
                    string str = txtusername.Text;
                    UserName = str.Split('@');
                    LoginBL.UserName = UserName[0].ToString();
                    str1 = UserName[0].ToString();
                }
                else
                {
                    LoginBL.UserName = txtusername.Text.Trim();
                    str1 = txtusername.Text.Trim();
                }
                LoginBL.Password = txtpassword.Text.Trim();
                string Role = LoginBL.GetUserLogin();

                if (Role == "NoUser")
                    lblMessage.Text = "User Name and password mismatch. Try again.";
                else
                {
                    Session["UserId"] = LoginBL.UserId;
                    Session["Emp_Cus_Id"] = LoginBL.Emp_Cus_Id;
                    if (Role == "Admin")
                    {
                        Session["UserName"] = str1;
                        Response.Redirect("~/Admin/AdminHome.aspx");
                        //FormsAuthentication.RedirectFromLoginPage("Admin", false);
                    }
                    else if (Role == "Employee")
                    {
                        Session["UserName"] = str1;
                        LoginBL.ActiveEmployeeOnlineStatus(Convert.ToInt32(Session["Emp_Cus_Id"]));
                        Session["UserType"] = "Employee";
                        Response.Redirect("~/Employee/EmployeeHome.aspx");
                        //FormsAuthentication.RedirectFromLoginPage("Employee", false);

                    }
                    else if (Role == "Customer")
                    {
                        Session["UserName"] = str1;
                        LoginBL.ActiveCustomerOnlineStatus(Convert.ToInt32(Session["Emp_Cus_Id"]));
                        Session["UserType"] = "Customer";
                        Response.Redirect("~/Customer/CustomerHome.aspx");
                        //FormsAuthentication.RedirectFromLoginPage("Customer", false);
                    }
                }
            }
            catch (Exception ex)
            {
                lblMessage.Text = ex.Message;
            }


What I have tried:

Master Page page_
C#
Load
=>

C#
if (Session["UserId"] == null || Session["Role"] == null
    || !Session["Role"].ToString().Equals(EnumUserRoles.Admin.ToString(), StringComparison.InvariantCultureIgnoreCase))
{
    arAdminHome.Visible = false;
    Response.Redirect("../LogIn.aspx");
}

Posted
Updated 26-Feb-16 0:35am

1 solution

The best approach is to stop "rolling your own" login and entry system. Instead, use something like Introduction to Membership[^] as that handles the security for you, including forbidding access to pages the user isn't allowed into, and making him log in first if he tries to access a page without permission.
You can add your own Custom Membership provider if you have special business rules to work with for the actual login.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900