Wednesday, 11 May 2005
Fix: Forms authentication redirects to a bogus default.aspx page, with RedirectFromLoginPage()
i've read a lot of posts on
microsoft.public.dotnet.framework.aspnet.security about people who ran
into problems using forms authentication, and the
RedirectFromLoginPage() method, which always redirects to a
default.aspx. this is a big problem if you use sub-folders that
don't have a default.aspx page, as in my case.
i read some posts
that suggested manually Response.Redirecting the user to the url in the
querystring, but actually this is incorrect because Forms Auth puts the
default.aspx in that querystring even if the user wasn't at a page
i put together a simple solution to get the redirecting to work properly, and am posting it here for future reference:
- The Login page (Login.aspx) must be set up to read the
HTTP_Referrer, and add it to the ViewState in the first Page_Load on
- In the btnLogin_Click event on Login.aspx, the SetAuthCookie()
event should be called, and the user should be Response.Redirected to
the referrer value in the viewstate.
- So you ignore the querystring that Forms Authentication adds on to the Login page.
Here is sample code:
private void Page_Load(object sender, System.EventArgs e)
ViewState["originalUrl"] = Request.UrlReferrer.AbsoluteUri;
private void btnLogin_Click(object sender, System.EventArgs e)
string originalUrl = ViewState["originalUrl"];
if(originalUrl == null || originalUrl == "") // in case the viewstate is corrupt, use default.aspx by 'default'
originalUrl = "default.aspx";
// do your password checking here
// if it's all ok then...
Wednesday, 11 May 2005 13:33:48 (GMT Daylight Time, UTC+01:00) Asp.Net