I've created a simple User Login page. Here User
is authenticated [username, password] and if it is a valid user, values like username, name and role of the user is stored in the Session.
And according to the role of the user, the user is redirected to different pages. This is simple code, but please help me to make my login page more secure and add more functionality.
using System;
using System.Data;
namespace PROJECT.view.User
{
public partial class LoginUser : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
try
{
Session.Clear();
Session.Abandon();
}
catch (Exception)
{
throw;
}
}
protected void btnSignIn_Click(object sender, EventArgs e)
{
try
{
DataTable dt = new DataTable();
dt = new C_User().Get_LoginUser(inputUserName.Value, inputPwd.Value);
if(dt != null && dt.Rows.Count > 0)
{
DataRow dr = dt.Rows[0];
Session["username"] = dr["USERNAME"].ToString();
Session["name"] = dr["NAME"].ToString();
Session["role"] = dr["ROLE"].ToString();
#region affiliated user pages
Int16 userRole = 0;
userRole = Convert.ToInt16(Session["role"]);
switch (userRole)
{
case 1:
Response.Redirect("Registration.aspx", false);
break;
case 2:
Response.Redirect("Medicine_1.aspx", false);
break;
case 3:
Response.Redirect("PortalRegister.aspx", false);
break;
case 4:
Response.Redirect("Billing.aspx", false);
break;
}
#endregion
}
else
{
Response.Redirect("LoginUser.aspx", false);
return;
}
}
catch (Exception)
{
throw;
}
}
}
}
inputPwd.Value
seems to mean you store the password in plain text. Don't do that.dt.Rows.Count > 0
is a wrong test. It makes me feel like you can have 2 or more users with the same userName and password. Test should bedt.Rows.Count == 1
\$\endgroup\$