Secure some files of the Application

The best security in .net is the built in one i think look for articles on using web.config in .net

Mart

Alright, the best thing to do is to write a custom script. This is not very difficult, but the code depents on how many users there will be.

For example, if you only have 1 user, administrator in this case, you can simply use `If ... Then` statements. If you have more users and want to add and delete users in admin.aspx, you will need an Acces database (or SQL, but I preffer Acces (*.mdb)).

You still havent got an answer, so I'll trie and write a little code here, with a admin users, who can acces the admin.aspx, and regular users, who can acces the order.aspx.

Step 1:    Create a Acces database with two tables (tblAdmin, tblUsers)

Step 2:    Set a password for the Acces database

Step 3:    Upload the database in a directory called /Databases (or something like that)

Step 4:    Create two new files, order.aspx and admin.aspx

 - Now, you can choose between code-behind or in-line coded pages, I choose code-behind, but that's just because VS.net wants that. You can use this code in regular pages by using <script runat="server" lanugage="vb">

Step 5:   // Content of Order.aspx.vb (code behind)

Import System.Data
Import System.Data.OleDb

'The page designer code is left out, so this is not something to cut and paste

Sub Page_Load (ByVal e As System.Eventargs, (I forgot the rest..))

Dim myCookie as HttpCookie

'Check if the user is loggedin

myCookie = HttpContext.Current.Request.Cookies("something")

Try

     If myCookie.Item("loggedin").ToString() = "-10--10" Then
        'User is loggedin, show the page
        Response.WriteFile("order_content.aspx.txt")
     Else
        'User is not loggedin, show the login page
        Response.Redirect("Login.aspx")
     End If
Catch
     'Cookie doesn't exists (so he's not loggedin)
     Response.Redirect("Login.aspx")
End Try

End Sub

// Content Login.aspx (No code behind here! This is just a plain page)

<form action="Check_Login.aspx" method="POST">
<input type="textbox" name="txtUsername" value="Username">
<br>
<input type="password" name="txtPassword" value="...">
<br>
<br>
<input type="submit" value="Login to Order.aspx">
</form>

// Content Check_Login.aspx

<%@ runat="server" language="vb" %>
<%@ Import namespace="System.Data"%>
<%@ Import namespace="System.Data.OleDb"%>

<script runat="server" language="vb">

Sub Page_Load(...)

Dim myConn as OleDbConnection
Dim myDataAdapter as OleDbDataAdapter
Dim sqlStr as String, connStr as String

connStr = // Connection String here, look at www.connectionstrings.com
myConn = New OleDbConnection(connStr)
myConn.Open

sqlStr = "SELECT * from tblUsers where username = '" & Request.Form("txtUsername") & "' And password = '" & Request.Form("txtPassword") & "'"
myDataAdapter = New OleDbDataAdapter(sqlStr, myConn)

If myDataAdapter.SelectCommand.ExecuteReader.Read.ToString() = False Then

    'Data isn't right
    Response.Redirect("Login.aspx")
    myConn.Close

Else

     'Data matches a user in the tblUsers
     Dim myCookie as HttpCookie
     myCookie = HttpContext.Response.Cookies("something")

     myCookie.Item("loggedin") = "-10--10"
     myCookie.Expires = Date() + 300
     Response.Redirect("Order.aspx")
     myConn.Close

End If

End Sub


The same thing is for the admin.aspx plus a couple of designer stuff. Now, I just wrote this in a few minutes, so don't trust it that much, it's just to give you an example of the way it works, if it works at all: the cookies are totaly different in ASP.Net, so some errors there I guess.

So don't reply if there is an error in it: I KNOW!