Question

Most of my ASP.NET website is accessible to an anonymous web users. However there are a few pages that I require authentication before I allow access. I control this via the web.config:

<authorization>
    <allow users="*"/>
</authorization>

Currently my logon.aspx file is generic, but I would really like to include instructions telling the user why he was redirected to the logon page. Something like:

Before you can volunteer for a task, please logon so the system can identify you.

OR

You’ve attempted to edit an event. The system only allows Administrators to do this. Please logon so we can verify you are an administrator of this event.

The instructions on the logon page would depend on what the user was attempting prior to the forms authentication redirect.

My problem is how can the logon page determine what action was taken? Is there anyway to pass a custom querystring to the logon page? I guess I could decode the ReturnUrl and use that to try an determine what instructions to display. However that approach just feels….dirty. I don’t like the logon page having a dependency on the URL names of other pages in the system.

Any suggestions?

Answer 1

You could use the HttpRequest.UrlReferrer Property to find out what was the user intention.

Or you could set a QueryString / Session variable before redirecting and use it to display some message.