Question

I’ building a website in visual studio.
At the beginning everything was OK and I managed to navigate between all my web pages.
I followed this tutorial (http://csharpdotnetfreak.blogspot.com/2011/12/createuserwizard-email-verification.html) in order to create a login page.

I managed to get the verification email to my email address but the link never worked, I always get error 400- bad request.

My problem is that now, I can’t access any of the webpages. It always takes me to the login.aspx page, even that I set a different page on the web.config file (under authentication). I tried to set other pages as a start page (via right click on project explorer).

Every time when I try to open a web page I’m getting an error 404 and the address in the address bar changes to localhost49171/login.aspx?Returnur%2fdefault.aspx%3f

Anyone has a solution?

Thanks in advance,

Liron

Answer 1

After checking you web.config, the behavior you are describing I would expect, as long as after logging you can navigate and access all the pages in your web site. If after logging in, you are still being redirected to the login page, you have something else setup wrong.

The configuration/web.config/authorization element in the web.config is used to specify site wide authorization rules.

<configuration>
  <web.config>
    <authorization>
      <deny users="?"  /> <!-- deny un-authenticated access, everyone not logged in that is -->
      <allow users="*"   /> <!-- allow everyone else -->
    </authorization>
  </web.config>
</configuration>

If you have resources that you may need to have accessible by anyone you can modify the authorization rules to that resource by using the configuration/location/system.web/authorization element

<configuration>
  <location path="SomeUnprotectedResource.aspx">
    <authorization>
      <allow users="*" /> <!-- anyone can view this page -->
    </authorization>
  </location>
</configuration>

You may even have resources that you need to further restrict access to the pages than what the site wide rules have.

<configuration>
  <location path="OnlyForMe.aspx">
    <authorization>
      <allow users="Me" /> <!-- only the user Me can view this page -->
      <deny users="*" /> <!-- deny everyone else -->
    </authorization>
  </location>
</configuration>

As a side note, if you have IIS setup to protect all web site resources (i.e. *.css, *.js) and not just the ASP.NET resources you will need to add rules to allow access to them as well. For example, you may have your JavaScript and styling external to the login page, as such they will likely need the styling and scripts to work.

<configuration>
  <location path="styles/login.css">
    <authorization>
      <allow users="*" />
    </authorization>
  </location>
  <location path="scripts/login.js">
    <authorization>
      <allow users="*" />
    </authorization>
  </location>
</configuration>