ASP.net : comment restreindre l’accès à toutes les pages de votre site Ecommerce

Dans ce qui suit nous expliquerons comment il faut procéder pour limiter l’accès à vos pages ASP.net à un groupe restreint d’utilisateurs préalablement autorisés.

Tout d’abord vous devez modifier le fichier web.config de manière à ce que l’authentification se fasse en mode Forms. Ensuite il faut créer une page d’authentification .aspx pour permettre à l’utilisateur de renseigner ses paramètres d’authentification.

Modifiez votre fichier web.config de la manière suivante :

_txtLoginID.Text))
dCmd.Parameters.Add(New OleDbParameter("Password", _

txtPassword.Text))

dr = dCmd.ExecuteReader( )

If (dr.Read( )) Then

'user credentials were found in the database so notify the system

'that the user is authenticated

FormsAuthentication.SetAuthCookie(CStr(dr.Item("UserName")), _

chkRememberMe.Checked)
'get the next page for the user
If (Not IsNothing(Request.QueryString(QS_RETURN_URL))) Then
'user attempted to access a page without logging in so redirect
'them to their originally requested page
nextPage = Request.QueryString(QS_RETURN_URL)
Else
'user came straight to the login page so just send them to the
'home page
nextPage = "Home.aspx"
End If
'Redirect user to the next page
'NOTE: This must be a Response.Redirect to write the cookie to the
' user's browser. Do NOT change to Server.Transfer which
' does not cause around trip to the client browser and thus
' will not write the authentication cookie to the client
' browser.
Response.Redirect(nextPage, True)
Else
'user credentials do not exist in the database - in a production
'application this should output an error message telling the user
'that the login ID or password was incorrect
End If

Finally
'cleanup
If (Not IsNothing(dr)) Then

dr.Close( )
End If
If (Not IsNothing(dbConn)) Then
dbConn.Close( )
End If
End Try
End Sub 'btnLogin_ServerClick
End Class 'Login
End Namespace


CODE SOURCE, code-behind (.cs)

//----------------------------------------------------------------------------

// Module Name: Login.aspx.cs

// Description: This module provides the code behind for the

// Login.aspx page

//****************************************************************************

using System;

using System.Configuration;

using System.Data;

using System.Data.OleDb;

using System.Web.Security;

using System.Web.UI.WebControls;

using System.Web.UI.HtmlControls;

namespace EcommerceDEV.VBSecurity.Login

{
public class Login : System.Web.UI.Page
{

// controls on the form
protected System.Web.UI.WebControls.TextBox txtLoginID;

protected System.Web.UI.WebControls.TextBox txtPassword;

protected System.Web.UI.WebControls.CheckBox chkRememberMe;

protected System.Web.UI.HtmlControls.HtmlInputButton btnLogin;

//************************************************************************
//
// ROUTINE: Page_Load
//
// DESCRIPTION: This routine provides the event handler for the page
// load event. It is responsible for initializing the
// controls on the page.
//------------------------------------------------------------------------
private void Page_Load(object sender, System.EventArgs e)
{
// wire the login button
this.btnLogin.ServerClick += new EventHandler(this.btnLogin_ServerClick);

} // Page_Load

//************************************************************************
//
// ROUTINE: btnLogin_ServerClick
//
// DESCRIPTION: This routine provides the event handler for the login
// button click event. It is responsible for
// authenticating the user and redirecting to the next
// page if the user is authenticated.
//
//------------------------------------------------------------------------
private void btnLogin_ServerClick(Object sender,
System.EventArgs e)
{
// name of querystring parameter containing return URL
const String QS_RETURN_URL = "ReturnURL";
OleDbConnection dbConn = null;
OleDbCommand dCmd = null;
OleDbDataReader dr = null;
String strConnection = null;
String strSQL = null;
String nextPage = null;
try
{
// get the connection string from web.config and open a connection
// to the database
strConnection =
ConfigurationSettings.AppSettings["dbConnectionString"];
dbConn = new OleDbConnection(strConnection);
dbConn.Open( );
// check to see if the user exists in the database
strSQL = "SELECT (FirstName + ' ' + LastName) AS UserName " +
"FROM AppUser " +
"WHERE LoginID=? AND " +
"Password=?";
dCmd = new OleDbCommand(strSQL, dbConn);
dCmd.Parameters.Add(new OleDbParameter("LoginID",
txtLoginID.Text));
dCmd.Parameters.Add(new OleDbParameter("Password",
txtPassword.Text));
dr = dCmd.ExecuteReader( );
if (dr.Read( ))
{
// user credentials were found in the database so notify the system
// that the user is authenticated
FormsAuthentication.SetAuthCookie((String)(dr["UserName"]),
chkRememberMe.Checked);
// get the next page for the user
if (Request.QueryString[QS_RETURN_URL] != null)
{
// user attempted to access a page without logging in so redirect
// them to their originally requested page
nextPage = Request.QueryString[QS_RETURN_URL];
}

else
{
// user came straight to the login page so just send them to the
// home page
nextPage = "Home.aspx";
}

// Redirect user to the next page
// NOTE: This must be a Response.Redirect to write the cookie to
// the user's browser. Do NOT change to Server.Transfer
// which does not cause around trip to the client browser
// and thus will not write the authentication cookie to the
// client browser.
Response.Redirect(nextPage, true);}
else

{// user credentials do not exist in the database - in a production
//application this should output an error message telling the user
// that the login ID or password was incorrect.} } // try

finally
{// cleanup
if (dr != null)
{dr.Close( );}

if (dbConn != null)
{dbConn.Close( );}} // finally
} // btnLogin_ServerClick
} // Login }
 

Kamal AOUDA

Ecommerce DEV

http://www.kamalaouda.com