loggin in

how do people go about this then?

[natty]

i can do a login fine, query the db etc, to check for a user/password etc.
is the way to do it to set a session var, or something of the sort , and in the top of all pages, do a check for that, and if not set, then redirect to the login page..?

i was just wondering what people thoughts are on this topic..
many thanks

nat

[defanjos]

I use something like the following:

<%
if Session("pw")="" AND Session("uid")="" then
response.redirect "login.asp"
end if
%>

If the person has not logged in, they'll be redirected to login.asp, so they can do so.

You can also place the asp code above in another file (loginverification.asp) and call it like:
<!-- #include file="loginverification.asp" -->

[Red_Eye]

I use Forms Authentication. In you web.config file you can choose the method of authentification. If you select forms you can then specify a default login page.

this is a snippit from one of my cofig files

<authentication mode="Forms">
<forms name="FMMWebAdmin" loginUrl="login.aspx" protection="All" path="/" />

</authentication>

you then handle the user login in the following way.

if (Page.IsValid == true)
{
//'u' is my users object
//Log user in
if(u.Login(u))
{
FormsAuthentication.RedirectFromLoginPage(u.UserName,false);
}
else
{
lblError.Visible=true;
lblError.Text="Username/Password incorrect please try again";
}
}

then you can decide what folders you want to protect for example: if you require a user to authenticate when accessing the admin folder. Simply add another web.config file with the following line to the admin folder.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</configuration>

This will mean that a user is shown the login screen when they try to access this folder.

[Xoc]

I should point out that defanjos solution is standard ASP, whereas Red_Eye's is ASP.NET.

Forms authentication in .NET is a little more complicated than Red_Eye indicated if you want to validate against info stored in a database. He showed the start, but once you get to the login page, you need to authenticate the user, then assign them a forms authentication ticket, which is stored in a cookie. You need to modify the global.asax to authenticate the user when they hit another page on the site. And you should provide a way to log out. See the links here [google.com].

[TheNige]

As far as I know when you use Forms Authentication, once you authenticate them you do not need to do the check on every page. You set up which directories are secure in the web.config and then the ASP.Net engine takes care of it for you. Very Simple.

[Red_Eye]

Sorry, I should have read the original post more carefully. Athentication does not need to be against a database, that is the great thing about forms authenfication you can decided how complicated your authenication process is.