Question about page redirection

janilane · August 21st, 2010, 12:05 AM

What makes the site go directly to Login.aspx whenever you try to cut and paste the URL of management folder without logging in as a manager (manager role)? Is it because ASP automatically detects the LOGIN CONTROL and assumes that the page which has it should be called?

Chapter 15, page 549 step 12.

thanks

Imar · August 21st, 2010, 03:48 AM

Hi there,

Nope, it's not the Login control as you could have many different pages in your site with a Login control.

It's centralized in web.config. The <forms /> element has a loginUrl attribute that defaults to Login,aspx. You can override it if you want:

Code:

 
<authentication mode="Forms">
  <forms loginUrl="SomeOtherPage.aspx"></forms>
</authentication>

Hope this helps,

Imar

janilane · August 22nd, 2010, 05:00 PM

thanks, but I'm referring to your C# version, I cannot find that section that you mentioned. Whenever I try to add a new album without logging in, or try to access 'my profile', it redirects me to the Login page. Is it something to do with ASP.NET <authorization> section?

thanks again.

Imar · August 22nd, 2010, 06:40 PM

You can't find it, because I just made up the loginUrl. Since it has a default value of Login.aspx, there's no need to specify it explicitly.

The loginUrl just defines the default login URL. It doesn't handle the security. This is done by the <location /> elements.
Did you check out the security chapter? This stuff is discussed in great detail in that chapter.

Cheers,

Imar

janilane · August 29th, 2010, 11:18 PM

Yes, I checked the security chapter and there was never any mention of a default file named LOGIN.ASPX that ASP.NET checks/redirects to when the attribute LoginURL is not used.

Is it always necessary to name the file Login.aspx whenever creating a login page when I decided not to use the attribute LoginURL as you have mentioned?

Imar · August 30th, 2010, 03:43 AM

No, correct. LoginUrl is not mentioned in that chapter. I corrected that in the 4.0 version of the book with:

Quote:

The authentication mechanism of ASP.NET by default assumes you have a page called Login.aspx in the root of your site that is used to let users log in. To be functional, the minimum that this page requires is a Login control. If you want to use a different page, you can specify its path in the <forms /> element under <authentication /> like this:

Code:

<authentication mode=âFormsâ>
<forms loginUrl=âMyLoginPage.aspxâ />
</authentication>

With this configuration you tell the ASP.NET runtime to load the page MyLoginPage.aspx whenever a user needs to present her credentials. Note that on the Login page (configured in the loginUrl) the VisibleWhenLoggedIn property of the Login control has no effect. On the configured Login page, the Login control is always visible. If you want to hide it you can use a LoginView control, as you see in a later exercise.

And yes, you either need to rely on Login.aspx or override the attribute. There is a default which you can use, but obviously when you don't like the default you need to override it somehow.

I was referring to the security chapter as a response to your question of why it redirects to the login page. Access to files and folders is determined by the <location /> elements in the config file.

Hope this helps,

Cheers,

Imar

janilane · August 30th, 2010, 07:59 PM

Thank you , this is very helpful. It has enlighten me so much. Will grab a copy of your new book from Amazon in due time so I can be updated on the changes as well.

cheers Imar