Question

I developed very simple web site, I have onle three web pages.

1. Logon.aspx
2. Register.aspx
3. MyAccount.aspx

Logon.aspx code:

        if (ValidateUser(email, password))
        {
            FormsAuthenticationTicket tkt;
            string cookiestr;
            HttpCookie ck;
            tkt = new FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now,
                                                DateTime.Now.AddMinutes(3), chkPersistCookie.Checked,
                                                email + "@ticket");
            cookiestr = FormsAuthentication.Encrypt(tkt);
            ck = new HttpCookie(FormsAuthentication.FormsCookieName, cookiestr);
            if (chkPersistCookie.Checked)
                ck.Expires = tkt.Expiration;
            ck.Path = FormsAuthentication.FormsCookiePath;
            Response.Cookies.Add(ck);

            string strRedirect;
            strRedirect = Request["ReturnUrl"];
            if (strRedirect == null)
                strRedirect = "MyAccount.aspx";
            Response.Redirect(strRedirect, true);
        }
        else
            Response.Redirect("logon.aspx", true);

Register.aspx code:

    private bool RegisterUser(string name, string surname, string email, string phone, string pass)
    {
        SqlConnection conn = new SqlConnection(@"Data Source=Server\SQL;Initial Catalog=Db;Integrated Security=True; User ID=user; Password =pass;");
        conn.Open();
        string insertQuery = @"INSERT INTO Users (Email, Name, Surname, Phone, Manager, Rank, Password)
                                VALUES (@Email, @Name, @Surname, @Phone, @Manager, @Rank, @Password)";
        SqlCommand cmd = new SqlCommand(insertQuery, conn);

        cmd.Parameters.Add("@Email", email);
        cmd.Parameters.Add("@Name", name);
        cmd.Parameters.Add("@Surname", surname);
        cmd.Parameters.Add("@Phone", phone);
        cmd.Parameters.Add("@Manager", "[e-mail]");
        cmd.Parameters.Add("@Rank", "1");
        cmd.Parameters.Add("@Password", pass);

        try
        {
            int rowsAffected = cmd.ExecuteNonQuery();
        }
        catch (Exception e )
        {

            throw;
        }
        finally
        {
            cmd.Dispose();
            insertQuery = string.Empty;
        }

Everything is perfect.
Now what I want is on Page_Load of MyAccount.aspx:

1. Get cookie
2. Check user Role
3. Based on user Role display required web site content.

But I am not sure how to do that.

1. Should I refer cookie to establish user role?
2. How do I generate HTML based on user role?

Thanks!

Answer 1

I don’t think you want to go generating much HTML based on role, more like you want content within your site to be only accessible to certain roles i.e. different pages and controls. This codeproject page is doing what you require.