Can't get Form Authentication to work...

I have setup a ASP.NET web application.
I have 2 forms:

• Login.aspx
• Main.aspx

My login page is bog standard. Username and password textboxes, a msg label and a login button.
My main page has a picture...simple :)

The code for the login page is:

VB Code:

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        'Put user code to initialize the page here
        lblMessage.Text = vbNullString
        Session.Abandon()
        FormsAuthentication.SignOut()
    End Sub
 
    Private Sub btnLogin_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogin.Click
        Dim objTicket As FormsAuthenticationTicket
        Dim objCookie As HttpCookie
        Dim strReturnURL As String
        If IsValid Then
            If txtUsername.Text = "wokawidget" And txtPassword.Text = "woof" Then
                objTicket = New FormsAuthenticationTicket(txtUsername.Text, False, 5)
                objCookie = New HttpCookie(".ASPXAUTH")
                objCookie.Value = FormsAuthentication.Encrypt(objTicket)
                Response.Cookies.Add(objCookie)
                strReturnURL = Request.Params("ReturnURL")
                If strReturnURL Is Nothing Then
                    Response.Redirect("Main.aspx")
                Else
                    Response.Redirect(strReturnURL)
                End If
            Else
                lblMessage.Text = "Incorect username/password"
            End If
        Else
            lblMessage.Text = "Incorect username/password"
        End If
    End Sub

...and I have the following in my web.config file:

Code:

---

<authentication mode="Forms">
        <forms
                name=".opsreport"
                loginUrl="login.aspx"
                protection="All"
                slidingExpiration="true"
                timeout = "10"
        />
</authentication>
<authorization>
        <allow users="*" /> <!-- Allow all users -->
        <deny users="?" /> <!-- Deny anon users -->   
</authorization>

---

Now, according to all the stuff I have read then this should force users to get redirected to my login page if they have not signed in. However, it allows me to view the main.aspx page WITHOUT having to login :(

Why?

Woka

FishCake has just told me that I need to remove this line:

Code:

---

<allow users="*" />

---

But I was under the impression that this means ALL users who HAVE signed in can view the pages, and doing:

Code:

---

<deny users="?" />

---

Means that to view any page they must me signed in.

I have removed this line from my web.config file and yes, when I go to Main.aspx it redirects the user to the Login page. This works as I expected.
However, when I login I try and redirect the user to the main page, as you can see from my login code, but what actually happens is that it gets redirected BACK to my loginscreen even if you enter the valid username and password.

Am I doing something wrong?

Woof

This isn't something i deal with much as i did it once and always reuse my old code so not sure exactly how formsauthentication works but if you modify your code like this

VB Code:

Private Sub btnLogin_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogin.Click
        Dim objTicket As FormsAuthenticationTicket
        Dim objCookie As HttpCookie
        Dim strReturnURL As String
        If IsValid Then
            If txtusername.Text = "wokawidget" And txtPassword.Text = "woof" Then
                'objTicket = New FormsAuthenticationTicket(txtusername.Text, False,5)
                FormsAuthentication.SetAuthCookie(txtusername.Text, False)
                'objCookie = New HttpCookie(".ASPXAUTH")
                'objCookie.Value = FormsAuthentication.Encrypt(objTicket)
                'Response.Cookies.Add(objCookie)
 
                strReturnURL = Request.Params("ReturnURL")
                If strReturnURL Is Nothing Then
                    Response.Redirect("Main.aspx")
                Else
                    Response.Redirect(strReturnURL)
                End If
            Else
                lblmessage.Text = "Incorect username/password"
            End If
        Else
            lblmessage.Text = "Incorect username/password"
        End If
    End Sub

You will be redirected as expected and if you wish you can still go ahead and set your own cookie.

What is the difference in security there?

Woka