Forms Auth and CrossPagePostback (aspnet 2.0)

[C. Moya]

I need to be able to postback to a different page from my login page (using
FormsAuthentication). After a lot of research, I was able to get the
postback to work by adding a <location> element for the target page in
web.config (so it's excluded from forms authentication).

HOWEVER, although the postback now works... the Page.PreviousPage property
returns a
"The current user is not allowed to access the previous page" exception. Not
sure what I'm doing wrong.

P.S.
Yes, Server.Transfer works... but I need the "redirect" so I can kick off
the session (which I have turned off in the Login page).

 

[C. Moya]

Adding a Location element in web.config for the source Logon form seems to
solve the crosspage postback problem. Does anyone know if there any security
implications for this?

Example:
<location path="Logon.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="LogonCont.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>

 

[C. Moya]

Yes, FormsAuthentication automatically takes care of the "Login Page" being
accessible. But if it posts back to a different page ("crosspage postback"
via the submit button's PostBackUrl property... which is what I'm trying to
do), the second page is not allowed and the user is automatically redirected
to the Login page.

Adding the second partner page to the Locations element in web.config solves
the problem.

P.S.
In case your wondering, the reason I'm using cross page postback in this
particular scenerio is that we don't want the Login page to kick off the
session... so we have its EnableSessionState=False. Once the user clicks
submit (whether or not his credentials are accepted) we kick off the
session... the postback page has EnableSessionState=True.

--
-C. Moya
www.cmoya.com

Not sure what you mean here. You have to allow unauthenticated users
access
to the login page, or they would never be able to log in, correct? If you
are
concerned that an unauthenticated user might hit the second page without
having first logged in, just check User.Identity.IsAuthenticated in the
Page_Load handler of the second page.
Peter

--
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short urls & more: http://ittyurl.net