Forms Authentication going back to previous page

[tshad]

I have a logon page that is getting the previous page in its return URL
("logon.aspx?returnURL=A.aspx") where A.aspx is the page that called B.aspx.
It should have B.aspx.

I am calling B.aspx using server.transfer. Could this be causing a problem?

Thanks,

Tom

 

[Steve C. Orr [MVP, MCSD]]

Yes, that is the cause of the problem.

You don't need to use the default RedirectFromLoginPage if you don't want.
Instead you can use SetAuthCookie and then do a regular Response.Redirect to
wherever you'd like.
Here's more information:
http://authors.aspalliance.com/aspxtreme/sys/Web/Security/FormsAuthenticationClassSetAuthCookie.aspx

 

[tshad]

Yes, that is the cause of the problem.

You don't need to use the default RedirectFromLoginPage if you don't want.
Instead you can use SetAuthCookie and then do a regular Response.Redirect
to
wherever you'd like.
Here's more information:
http://authors.aspalliance.com/aspxtreme/sys/Web/Security/FormsAuthenticationClassSetAuthCookie.aspx

That doesn't seem to be my problem. This was working fine before, not sure
what I did to mess it up.

I think I partially figured out what is happening.

I have pages A, B and C and a logon page.

Page A calls B (server.transfer("B"))

This should have went to logon as I have forms authentication on. But it
doesn't and I don't have as a Location in my web.config file.

Page B calls C (server.transfer("C")) and gets the logon page with B as the
returnURL (should have been C).

Tom.

 

[Steve C. Orr [MVP, MCSD]]

Try using Response.Redirect instead of Server.Transfer and see if that fixes
it.

 

[tshad]

Try using Response.Redirect instead of Server.Transfer and see if that
fixes it.

It did.

I was just reading up on it and it says that Server.Transfer keeps the old
URL and I assume that was why the returnURL had that page in it.

This would be a problem, then, if we are concerned with security as we have
a timeout and expect that if a person waits too long and goes to the next
page and had used Server.Redirect, it would go to the wrong page.

I was trying to use Server.Transfer as it was supposed to save resource, but
this would be a drawback.

Thanks,

Tom