Home/ Questions/Q 9173381
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T16:34:35+00:00

Objective Restrict direct URL access to all pages but Logon.aspx ensuring that a user

  • 0

Objective

Restrict direct URL access to all pages but Logon.aspx ensuring that a user must be referred to every other page.

Driver

The driver behind this requirement is our internal security department. They feel that this is the only acceptable solution to ensure the application is always secure.

Problem

The problem is two-fold, so let’s deal with the first one. If a user is logged in and on a page they can copy the URL, open up a new tab, close the previous tab, paste the URL, and the session is still alive. I understand why this is happening but they are saying we need to keep that from happening. And please don’t ask me why, if I could answer that I probably would be convincing them otherwise.

The second part of the problem is that the way the application was originally written (insert really angry face here) two of the web forms are reused for enrollment. This specifically means that those pages are accessible even if the user isn’t logged in. However, we have to make it so that they were specifically referred to those pages through the process flow and thus not directly accessible.

As an example for the aforementioned paragraph, consider the following. The user copies the URL to one of the shared forms, opens up a new browser, and pastes in the URL. The session is dead but the form displays for the purposes of enrollment. However, this is problematic because they haven’t accepted the terms and they have broken the already fragile flow.

What have I tried?

Honestly, nothing. I’m up here panning for ideas because the best I’ve seen thus far Googling is stuff surrounding ensure the user is logged in first. Some use cookies and others use the membership provider, but the fact that the user is logged in already doesn’t address either of my problems.

I look forward to hearing from you all!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Once user has been logged into the system , what the point of hiding anything which you have given access. but anyways here might be few ways to do this:-

    For the first the My suggestion is to wrap your page inside an IFrame and disable the right click, so that you cannot access the view source or link information.

    Once above is achievable . you can also attach a token to every URL. then you can check the if token is available or not. If available , request is valid, else invalid request.

    I will give you more solution if crossed my mind.

    • 0