Question

I have a folder in my webserver with some aspx pages that can only be accessed if a certain cookie exists.

On th page_load event i’m checking whether this cookie exists, if not redirect to Default.aspx. This works great with browsers such as Google Chorme and FireFox (3, I have not tested 2 yet). But… for some reason IE will send some sort of cookie still as my website thinks that there is a cookie available of some sorts..

So I added a button to my page to delete the cookie. but the cookie does not exist according to my code (which is correct). My assumption then was that IE caches the page. So after wiping the cache does my page code work properly and you get redirected to Default.aspx.

Is there some sort of way to deny access to the folder if that cookie does not exist, so that IE isn’t showing a page that doesn’t work?

It’s kind of hard to explain.

My cookie checking code is this:

protected void Page_Load(object sender, EventArgs e)
{
   {
      SimpleAES decrypt = new SimpleAES();
      //Check for Authentication Cookie
      HttpCookie auth_Cookie = new HttpCookie("WEB_AUTH");
      auth_Cookie = Request.Cookies["WEB_AUTH"];
      if (auth_Cookie != null)
      {
         //Some code to execute if Cookie exists and holds correct values
      }

      else
      { 
         //If there isn't a cookie, redirect to login.aspx
         Response.Redirect("~/Default.aspx"); 
      }
   }
}

Any help provided would be welcome!
Thanks

ADDED
I just want these pages in folder ‘XXX’ not be displayed if that cookie is not available. but IE loads the page from it’s local cache rather than check whether it can actually load this. What to do?

EDIT

The pages in the folder ‘XXX’ have 1 master page which is where the Cookie checking code resides in.

Answer 1

You need to prevent browser from caching the page. You should set Response.Cache according to your requirements ( http://msdn.microsoft.com/en-us/library/system.web.httpresponse.cache(v=VS.100).aspx).

Note that browser in theory can completely ignore your caching headers and load page from its own cache anyway, in practice all browsers respect caching headers.