Web Development

Ask something
Discussion Locked

Secure Web Site

0 helpful
7 replies

by jeremy the it guy 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have developed an ASP logon for "Client Access". Once a client is authenticated, they will be redirected to their own company page. Well, this is susposed to be secure and if someone were to just type in the URL for the client's page, they can go there without any authentication. Can some one help? Here is the scenerio. If you go to http://www.myweb.com and click client access, then authenticate, the url looks like this: http://www.myweb.com/clientaccess/company.html. Well, if you wereto bypass the authentication and just type in the url above, you could get to this page. Thanks for the help, Jeremy

7 replies

by gigelul

You don't say how is built your Web server (OS, IIS, etc) but generaly you must check Directory security options (for folder structure of your web) and disable anonymous access and allow only Athentication control method for these folders.

by jeremy the it guy

My setup is IIS 5.0 on a Windows 2000 Pro machine but I can easily switch it to 2000 Server. If I were to disable anonymous connections, how can I use my ASP page for authentication? Can I? I have tried the directory security but I haven't tried to disable anonymous connections yet because I don't know how to make my ASP page my authorization page. Could you help? Thanks, Jeremy
If you help, I'll give you the points.

by jay eckles

One possibility is to make each company page part of the same ASP application, you can use the sessino variable to hold an "authenticated" flag. You could then check that before displaying the company page. However, using authentication from the web server is a better choice.

Good luck.

Jay Eckles

by jeremy the it guy

Could you give me an example? I would like to do the web server authentication too but then don't I have to have an NT username and password for each person viewing the page? Thanks, Jeremy

by iht4

One simple solution (although not fully secure)would be to control the referring page for your company sites. If this was restricted to only allowing people who have come from your client access page to continue, all other direct url requests couldthen be redirected to the logon page.

for example, http://javascript.internet.com/user-details/referrer-redirect.html demonstrates this functionality.

rgds
Iain

by jeremy the it guy

I went with session IDs and I forgot to close this question. I got every page that I want to secure requesting 2 sessionIDs and if they aren't there, they are redirected to the logon page. Thanks for yout help though, Jeremy

This discussion is closed to new replies.