Code Review Stack Exchange is a question and answer site for peer programmer code reviews. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been tasked with implementing a secure account login system for a website's content management system. I have built a solution around an access masterpage that handles all account access functions. Here is the Page_Load

Protected Sub Page_Load() Handles Me.Load
    If Not Request.IsSecureConnection Then
        Response.Redirect(Request.Url.ToString.Replace("http://", "https://"))
    End If
End Sub

And the definition of UpdateSecurity()

Private Sub UpdateSecurity()
    PageContentPanel.Visible = Session("access")
    PleaseLogInPanel.Visible = Not Session("access")
End Sub

As you can probably infer from the snippet, having "access" set in the Session makes an asp:Panel containing the content of whatever child page the user requested visible, otherwise, the PageContentPanel is hidden, and the PleaseLogInPanel with a username and password prompt is made visible. In the handler for the login button (also on the login Panel), the posted credentials are verified and if correct, Session values are added.

I was wondering if this implementation is fundamentally sound or not. Page requests from not logged in users still execute (I think), but the results are hidden inside an invisible asp:Panel. I'm not familiar enough with the ASP.NET security model to know if this poses risks or not from wayward POSTs. If a child page utilizes this masterpage, what access do not logged in users have to resources on the page?

share|improve this question

What you are doing right now is not fundamentally correct. This link explains developing a custom authentication module.

Also you should read about page life cycle while working asp webforms.

share|improve this answer
why is what I'm doing not fundamentally correct? Where is the hole? – twsaef Dec 5 '11 at 0:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.