Web.config + Locking certain users out of a particular page

M

mike55

Contributor
Joined
Mar 26, 2004
Messages
727
Location
Ireland
Hi,

When my user logs into the system, I create a session variable to store their username and their access level, currently there are only two access levels 1 => administrator or 2 => manager.

The manager has only permission to view some of the pages. Is it possible to set in the web.config file, that a particular page can only be viewed if a person has access = 1.

This is in response to someone once they have logged into the system simple typing the url of a page that they are not suppose to be able to see.

Mike55
 
Rather than implementing your own security model you may want to look at Forms Authentication. that would give you a simple method of administering access via the web.config.
 
PlausiblyDamp said:
Rather than implementing your own security model you may want to look at Forms Authentication. that would give you a simple method of administering access via the web.config.
Click to expand...

Yea, am using Form Authentication, however I need to effectively lock down some pages to prevent a certain class of user gaining access to that page.

Mike55.
 
If you are already using forms authentication why are you also storing the user name and access level in a variable? You can always get the username via the User object (User.Identity.Name) and you could then implement a basic group model to control access to resources.
 
mike55 said:
Yea, am using Form Authentication, however I need to effectively lock down some pages to prevent a certain class of user gaining access to that page.

Mike55.
Click to expand...
Each page (in Page_Load) needs to validate security level. If they have access, continue to load, otherwise redirect to error page.
 
Back
Top