Question

I have two pages: Members.aspx and Admins.aspx. I want to make unlogged users to see none of them, any logged user to see the first one and only certain users to see both.

User’s category (“member” or “admin”) is detected at login time from the code and is put in a session variable.

I can easily grant access to any logged user to some page using Forms Authentication (basically as described here), but how should I design my web.config in order to take in account not the username but his category?

Note that users could anytime change their category so i can’t hard-code their names, and I need this to be db-independent so I shall stick to Forms Authentication login mode.

Answer 1

You really should look into

Asp.net roles management

And

Filtering Site-Map Nodes Based on Security Roles

It would be smarter than trying to build your own security mechanism based upon Session values.