Click here to Skip to main content
15,116,815 members
Please Sign up or sign in to vote.
2.00/5 (1 vote)
See more:
Hello friends
My name is Sarfaraz. I am facing a problem in securing few pages of my asp.net website where I am supposed to secure few pages from all users other than ad admin only a single person with a username and password stored in SQL server. Everything is working fine but when i type the url of the secured page directly in the address bar it gets opened up without redirecting to the login page first.Please help
my code is
<br />
 private bool AuthenticateUser(String username, string password)<br />
    {<br />
        string cs = ConfigurationManager.ConnectionStrings["HamdardConnectionString"].ConnectionString;<br />
        using (SqlConnection con = new SqlConnection(cs))<br />
        {<br />
            SqlCommand cmd = new SqlCommand("mp_authenticateadmin",con);<br />
            cmd.CommandType = CommandType.StoredProcedure;<br />
<br />
            SqlParameter paramUsername = new SqlParameter("@Username",username);<br />
            SqlParameter paramPassword = new SqlParameter("@Password", password);<br />
<br />
            cmd.Parameters.Add(paramUsername);<br />
            cmd.Parameters.Add(paramPassword);<br />
<br />
            con.Open();<br />
            int ReturnCode = (int)cmd.ExecuteScalar();<br />
            return ReturnCode == 1;<br />
<br />
<br />
        }<br />
<br />
    }<br />
  <br />
 <br />
    <br />
    protected void btnloginn_click(object sender, EventArgs e)<br />
    {<br />
        if (AuthenticateUser(txtusername.Text, txtpassword.Text))<br />
        {<br />
            FormsAuthentication.RedirectFromLoginPage(txtusername.Text,true);<br />
<br />
<br />
        }<br />
        else<br />
        {<br />
            lblerror.Text = "Invalid Username or /and Password";<br />
<br />
        }<br />
    }<br />
<br />

and my web.config file is
<br />
<configuration><br />
  <connectionStrings><br />
    <add name="HamdardConnectionString" connectionString="Data Source=localhost;Initial Catalog=Hamdard;Integrated Security=True"<br />
      providerName="System.Data.SqlClient" /><br />
  </connectionStrings><br />
    <br />
  <system.web><br />
    <compilation debug="true" targetFramework="4.0"/><br />
<br />
      <authentication mode="Forms"><br />
          <forms loginUrl="Login.aspx" defaultUrl="Default.aspx"><br />
          </forms><br />
      </authentication><br />
<br />
<br />
      <authorization><br />
          <deny users ="?" /><br />
          <br />
      </authorization><br />
    </system.web><br />
</configuration><br />
Posted

1 solution

To start with, you should never store any passwords anywhere; it is unsafe and absolutely not needed for authorization. Surprised? Disagree? Then please see my past answers:
i already encrypt my password but when i log in it gives me an error. how can decrypte it[^],
Decryption of Encrypted Password[^],
storing password value int sql server with secure way[^].

So, you simply should not implement the functionality you are trying to implement. You need to re-implement it in a reasonable way first, and then address the bugs, if you have them again.

—SA
   
Comments
Kornfeld Eliyahu Peter 29-Apr-14 13:42pm
   
I think, that you should write 'store any plain password', it's may be much easier for beginners to understand...
Sergey Alexandrovich Kryukov 29-Apr-14 15:33pm
   
Consider my wording is a provocative style of saying it, the detail are in my past answers references. You should agree that formally my statement is correct: a hash function of a password is not a password, not at all. And this is not an "encoded" password: there is no on-to-one correspondence between set of passwords and their hash functions.
—SA
Kornfeld Eliyahu Peter 29-Apr-14 15:39pm
   
I agree with you. It was only an observation...A thought...

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)




CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900