Question

I’m using ASP.net and the only ‘member’ to the site will be me, with site-admin privileges. I’m setting it up so I can make small edits to pages without having to re-upload the site every time.

I have an “editpage.aspx” page that I’m going to have it send me to-to edit the page. How do I keep other nosy people from accessing the page without being logged in?

Answer 1

There are lots of ways to accomplish this. On my sites, where I have the only login (i.e. there is no need for a full-blow membership provider as everyone but the admin runs not logged in), after I login, I set a flag in a session variable. On each page that I need to protect I do this in the page load:

protected void Page_Load(object sender, EventArgs e)
    {
        if (Session["myUser"] == null)
            Response.Redirect("Login.aspx", true); 

That way, anyone that arrives on your page that is not logged in, gets redirected to the login page. This is a pretty simple solution, and easy to implement. But I wouldn’t hide state secrets behind it…but have never had a problem with unauthorized users getting into protected pages.

Using a session has the benefit of timing out so that if a logged in user walks away from his computer, after 20 minutes or so the session expires and they are no longer logged.