Suggestion Regarding Securing the ASP.NET Web Page......

Hi Everybody,
I have problem regarding security of the page. I want that the every asp.net
web page is accessed via application. If a user directly access the page via
writing the address of the page in the address bar. Then It should be
blocked to access the page.
I have two options in my mind.
1. Using Query String Parameters
2. Using Session Object
But I got the following problem with these techniques.
WIth Query String the problem is that if the user access the page via
application then the query string parameters are shown in the address bar so
there he can used these parameters in the direct access, which i did not
want.
With Session Object, If the user login from the application then its session
is created. so now he can write the direct address in the address bar to
access the page directly which i dont want.
Actully My application is frames base application.
There are threee frames vertically
1) Header
2) Body ( Body Portion contains the two horizontal frames )
2.1) Menu
2.2) Content
3) Footer
In the menu area user selects the menu and against that menu the page is
loaded in the content portion.
So please help me how can i block user to access the page directly.
Regards,
Muhammad Jamil NawazThe Request object will have an HttpRequest.UrlReferrer Property. If this
property does not have a value then it means that the user has typed the
URI. This is not a foolproff method though but can still keep the average
user.
Regards,
Trevor Benedict R
MCSD
"Muhammad Jamil Nawaz" <jamfiza12@.hotmail.com> wrote in message
news:%23$JElX80FHA.2752@.TK2MSFTNGP12.phx.gbl...
> Hi Everybody,
> I have problem regarding security of the page. I want that the every
> asp.net
> web page is accessed via application. If a user directly access the page
> via
> writing the address of the page in the address bar. Then It should be
> blocked to access the page.
> I have two options in my mind.
> 1. Using Query String Parameters
> 2. Using Session Object
> But I got the following problem with these techniques.
> WIth Query String the problem is that if the user access the page via
> application then the query string parameters are shown in the address bar
> so
> there he can used these parameters in the direct access, which i did not
> want.
> With Session Object, If the user login from the application then its
> session
> is created. so now he can write the direct address in the address bar to
> access the page directly which i dont want.
> Actully My application is frames base application.
> There are threee frames vertically
> 1) Header
> 2) Body ( Body Portion contains the two horizontal frames )
> 2.1) Menu
> 2.2) Content
> 3) Footer
> In the menu area user selects the menu and against that menu the page is
> loaded in the content portion.
> So please help me how can i block user to access the page directly.
> Regards,
> Muhammad Jamil Nawaz
>
Use Session.
Use the sessionstate as "auto" mode (not cookieless = false) to also
take care of scenarios where cookies may be disabled (a large section
of corporates disable cookies).
Cheers,
Gaurav Vaish
http://mastergaurav.org
--

Survey: What do you name your User table?

Most of the sites that I build have to deal with security at some
point, and this means that somewhere in the database there needs to be
a list of Users.

The naming convention that I (and most everybody I've ever worked with
that cares about such things) use dictates that a table should be named
according to what it contains, and that this name should be singular.
So, Customer, User, Entry are all good, while Customers, Users, Entries
are not so good. Thus, nobody has to deal with Junior Dev Jimmy's
magic ID generation code that occasionally tries to bind a column to
"EntrieID".

The issue I keep running into is that "User" is essentially a reserved
word in ASP.NET, being a property of Page. Thus, I can't use it as the
ClassName for my DataObject that wraps the User table. Thus, I
probably shouldn't be naming the table "User", since every other
DataObject always is named after the table it represents.

I've tried going with "Login" to describe users, but this usually
crashes into somebody's Login.aspx Page object, and besides it's not
quite descriptive enough for my tastes.

That leaves us with "Users" (thus breaking our naming convention),
"tblUser" "UserTable" or "UserRecord" (which all look silly on the
url), "Individual" or "Dude" (which I've actually gone with in the
past).

I'm curious what other people have come up with to attack this problem.
I'm sure I'm not the only one running into it. Let me know what you
think!

Jason Kester
Expat Software Consulting Services
http://www.expatsoftware.com/because tables are sets, i (like the sqlserver dev group) always make them
pural, so my users table name is Users. in your case UserInfo is probably a
good name.

-- bruce (sqlwork.com)

"jasonkester" <jasonkester@.gmail.com> wrote in message
news:1125699677.612465.206070@.g43g2000cwa.googlegr oups.com...
> Most of the sites that I build have to deal with security at some
> point, and this means that somewhere in the database there needs to be
> a list of Users.
> The naming convention that I (and most everybody I've ever worked with
> that cares about such things) use dictates that a table should be named
> according to what it contains, and that this name should be singular.
> So, Customer, User, Entry are all good, while Customers, Users, Entries
> are not so good. Thus, nobody has to deal with Junior Dev Jimmy's
> magic ID generation code that occasionally tries to bind a column to
> "EntrieID".
> The issue I keep running into is that "User" is essentially a reserved
> word in ASP.NET, being a property of Page. Thus, I can't use it as the
> ClassName for my DataObject that wraps the User table. Thus, I
> probably shouldn't be naming the table "User", since every other
> DataObject always is named after the table it represents.
> I've tried going with "Login" to describe users, but this usually
> crashes into somebody's Login.aspx Page object, and besides it's not
> quite descriptive enough for my tastes.
> That leaves us with "Users" (thus breaking our naming convention),
> "tblUser" "UserTable" or "UserRecord" (which all look silly on the
> url), "Individual" or "Dude" (which I've actually gone with in the
> past).
> I'm curious what other people have come up with to attack this problem.
> I'm sure I'm not the only one running into it. Let me know what you
> think!
>
> Jason Kester
> Expat Software Consulting Services
> http://www.expatsoftware.com/
UserProfile, UserRegistrationInfo, RegisteredUsers, UserCredentials...

Johm

Survey: What do you name your User table?

Most of the sites that I build have to deal with security at some
point, and this means that somewhere in the database there needs to be
a list of Users.
The naming convention that I (and most everybody I've ever worked with
that cares about such things) use dictates that a table should be named
according to what it contains, and that this name should be singular.
So, Customer, User, Entry are all good, while Customers, Users, Entries
are not so good. Thus, nobody has to deal with Junior Dev Jimmy's
magic ID generation code that occasionally tries to bind a column to
"EntrieID".
The issue I keep running into is that "User" is essentially a reserved
word in ASP.NET, being a property of Page. Thus, I can't use it as the
ClassName for my DataObject that wraps the User table. Thus, I
probably shouldn't be naming the table "User", since every other
DataObject always is named after the table it represents.
I've tried going with "Login" to describe users, but this usually
crashes into somebody's Login.aspx Page object, and besides it's not
quite descriptive enough for my tastes.
That leaves us with "Users" (thus breaking our naming convention),
"tblUser" "UserTable" or "UserRecord" (which all look silly on the
url), "Individual" or "Dude" (which I've actually gone with in the
past).
I'm curious what other people have come up with to attack this problem.
I'm sure I'm not the only one running into it. Let me know what you
think!
Jason Kester
Expat Software Consulting Services
http://www.expatsoftware.com/because tables are sets, i (like the sqlserver dev group) always make them
pural, so my users table name is Users. in your case UserInfo is probably a
good name.
-- bruce (sqlwork.com)
"jasonkester" <jasonkester@.gmail.com> wrote in message
news:1125699677.612465.206070@.g43g2000cwa.googlegroups.com...
> Most of the sites that I build have to deal with security at some
> point, and this means that somewhere in the database there needs to be
> a list of Users.
> The naming convention that I (and most everybody I've ever worked with
> that cares about such things) use dictates that a table should be named
> according to what it contains, and that this name should be singular.
> So, Customer, User, Entry are all good, while Customers, Users, Entries
> are not so good. Thus, nobody has to deal with Junior Dev Jimmy's
> magic ID generation code that occasionally tries to bind a column to
> "EntrieID".
> The issue I keep running into is that "User" is essentially a reserved
> word in ASP.NET, being a property of Page. Thus, I can't use it as the
> ClassName for my DataObject that wraps the User table. Thus, I
> probably shouldn't be naming the table "User", since every other
> DataObject always is named after the table it represents.
> I've tried going with "Login" to describe users, but this usually
> crashes into somebody's Login.aspx Page object, and besides it's not
> quite descriptive enough for my tastes.
> That leaves us with "Users" (thus breaking our naming convention),
> "tblUser" "UserTable" or "UserRecord" (which all look silly on the
> url), "Individual" or "Dude" (which I've actually gone with in the
> past).
> I'm curious what other people have come up with to attack this problem.
> I'm sure I'm not the only one running into it. Let me know what you
> think!
>
> Jason Kester
> Expat Software Consulting Services
> http://www.expatsoftware.com/
>
UserProfile, UserRegistrationInfo, RegisteredUsers, UserCredentials...
Johm