I use this trick frequently.
I can secure a website in a matter of minutes, using the ASP.Net Login Server Control, editing a couple lines of server-side code, and editing the web.config.
This doesn't require a database, just adding the user's credentials to the web.config.
When I am finished, this code will cause an unauthenticated visitor to my website to be redirected to Login.aspx. Once valid credentials are submitted, the visitor will be sent to either the default page or the page originally requested.
This is not necessarily the best way to do this, as the credentials are sent over the internet in clear text, so they could be seen if someone is watching your network traffic.
First, in the
web.config:
<?xml version="1.0"?>
<configuration>
<system.web>
<compilation debug="false"/>
<authentication mode="Forms">
<forms loginUrl="Login.aspx"
defaultUrl="Default.aspx">
<credentials>
<user name="LOGIN_USERNAME" password="PASSWORD" />
</credentials>
</forms>
</authentication>
<authorization>
<allow users="LOGIN_USERNAME" />
<deny users="*" />
</authorization>
</system.web>
</configuration>Next, I create a new webform, named
Login.aspx. Drop the Login control on the page, accept the default name (Login1).
Select the Login control and set the DestinationPageUrl property to Default.aspx page.
Double-click the login control to generate the event handler.
Login.aspx.csYou will need the following directives in the code-behind:
using System;using System.Web.Security;using System.Web.UI.WebControls;
And the code-behind event handlers:
protected void Page_Load(object sender, EventArgs e){ Login1.Focus(); //set focus to username field
}protected void Login1_Authenticate(object sender, AuthenticateEventArgs e){ if(FormsAuthentication.Authenticate(Login1.UserName, Login1.Password))
e.Authenticated = true;}That's it. Securing a website in less than 20 typed lines of code / configuration.