Why doesnt ThePhile put the secure pages in the web.config like:

<location path="Checkout.aspx">
        <system.web>
            <authorization>
                <deny users="?" />
            </authorization>
        </system.web>
    </location>

And also use:
FormsAuthentication.RedirectFromLoginPage(customer Id, RememberLogin.Checked);

instead of redirecting to a default page everytime a user logs in???

There are load of different ways to use the web.config to deny access to pages. You can blanket whole directories, or individual files like you said.

As for the redirection, maybe they decided not to use it, or didnt know it was there. There are loads of descrepencies in the book from start to finish, you can tell that by the way the classes change chapter to chapter and for instance the way objects are populated changes and is not consistent. using the ASP.Net redirect is probably the best solution, problem with is, if you go straight to the login page, then the return URL queryString value does not exist, so you have to account for that.

Rob

You are right in everything u have said. As I dig deeper into the book, I also noticing a lot of descrepencies. But still authors have done a good job showing how .net works altogether.

You wrote:
"problem with is, if you go straight to the login page, then the return URL queryString value does not exist, so you have to account for that."

I also thought of this issue. I will tackle it by not sending the users directly to the login page. I will always send the users to other secure pages, such as MyAccount.aspx or Checkout.aspx, which should re-direct the user to the login page.

regards

ThePhile was set up to use imperative (code) instead of declarative (config file) security. This gives the most flexibility because we are using the custom principal object from the base class.

To be fair, this design is probably overkill for the intended purpose. They wanted it to grow into something a lot larger, so sometimes the design seems bloated and inconsistant. I hope they pick up with a sequel to this book so the design can be further refined.

Eric