Securing website without using default DB but using FormsAuthentication
Ok, Im so excited to have finally figured this out. Many times a programmer is going to want to give access to certain folders in their site but not want to use the default database that comes with VS.
so here's the code
//check if they login to database or xml file, the 1st 2 lines of code will be you connecting to
//DB and then determining what that users Status should be.
Login Login1 = (Login)LoginView1.FindControl("Login1");
if ((Login1.UserName == "test") && (Login1.Password == "pass"))
{
if (Request.QueryString["ReturnUrl"] != null)
{
FormsAuthentication.RedirectFromLoginPage("admin", false);
//if my DB says they are admin then i make them an admin and redirect to page they where
//trying to access
}
else
{
//if my DB says they are admin then i make them an admin and redirect to default.aspx
FormsAuthentication.SetAuthCookie("admin", false);
Response.Redirect("default.aspx");
}
}
else
{
//login from DB or XML failed
}
heres the web.config file placed in folder u want to protect i had to take out tags cause blog doesn't like them. deal with it
system.web
authorization
allow users="admin"/
deny users="*" /
/authorization
/system.web
so here's the code
//check if they login to database or xml file, the 1st 2 lines of code will be you connecting to
//DB and then determining what that users Status should be.
Login Login1 = (Login)LoginView1.FindControl("Login1");
if ((Login1.UserName == "test") && (Login1.Password == "pass"))
{
if (Request.QueryString["ReturnUrl"] != null)
{
FormsAuthentication.RedirectFromLoginPage("admin", false);
//if my DB says they are admin then i make them an admin and redirect to page they where
//trying to access
}
else
{
//if my DB says they are admin then i make them an admin and redirect to default.aspx
FormsAuthentication.SetAuthCookie("admin", false);
Response.Redirect("default.aspx");
}
}
else
{
//login from DB or XML failed
}
heres the web.config file placed in folder u want to protect i had to take out tags cause blog doesn't like them. deal with it
system.web
authorization
allow users="admin"/
deny users="*" /
/authorization
/system.web
