Question

In an imaginary situation, a user that shouldn’t have access to a web page navigates to that page.
This page is a child page. The user should not have ANY functionality in this page, or even be able to see anything, but he (or she) should be able to still use the master page controls. What do you do to disable the page?

I thought perhaps making a control element .visible=false, but is this secure? Is there some other way I should be disabling a page?

Answer 1

Provide a nopermission.aspx page that has the desired master page you wish, then in Page_Load redirect to that page

protected void Page_Load(object sender, EventArgs e)
{
    if(!HasPermission("User123"))   //User does not have permission
       Response.Redirect("nopermission.aspx");

    //otherwise, the page continues as required
}

You can put whatever friendly information you wish in the nopermission page