How to keep the Login.aspx page’s ReturnUrl parameter from overriding the ASP.NET Login control’s DestinationPageUrl property

asp.netforms-authentication

I'm using the ASP.NET Login Controls and Forms Authentication for membership/credentials for an ASP.NET web application. I've got pages such as PasswordRecovery.aspx that are accessable to only Anonymous users. When I click my login link from such a page, the login page has a ReturnUrl parameter in the address bar:

http://www.example.com/Login.aspx?ReturnUrl=PasswordRecovery.aspx

And then after a successful login, users are returned to the PasswordRecovery.aspx page specified in the ReturnUrl parameter to which they no longer have access.

Best Answer

I found the answer on Velocity Reviews. I handled the LoggedIn event to force a redirection to the DestinationPageUrl page.

Public Partial Class Login
    Inherits System.Web.UI.Page

    Protected Sub Login1_LoggedIn(ByVal sender As Object, _  
            ByVal e As System.EventArgs) Handles Login1.LoggedIn
        'overrides ReturnUrl page parameter
        Response.Redirect(Login1.DestinationPageUrl)
    End Sub

End Class

Related Solutions

R – How to use ASP.NET Login Controls when the Login.aspx is not at the root of the application

Use the LoginUrl property for the forms item?

<authentication mode="Forms">
  <forms defaultUrl="~/Default.aspx" loginUrl="~/login.aspx" timeout="1440" ></forms>
</authentication>

R – How to best handle role based permissions using Forms Authentication on the ASP.NET web application

A couple solutions off the top of my head.

You could set up restrictions for each page in your web.config file. This would allow you to have whatever folder hierarchy you wish to use. However, it will require that you keep the web.config file up to date whenever you add additional pages. The nice part of having the folder structure determine accessibility is that you don't have to think about it when you add in new pages.
Have your pages inherit from custom classes (i.e. EveryonePage, UserPage, AdminPage, etc.) and put a role check in the Page_Load routine.

Best Answer

Related Solutions

R – How to use ASP.NET Login Controls when the Login.aspx is not at the root of the application

R – How to best handle role based permissions using Forms Authentication on the ASP.NET web application

Related Topic