I am creating a simple website with a login page and some "admin only"
pages.
In my login page's submit button I just say if the "password is correct"
then...
session("IsAdmin") = True
In my admin only pages I check if session("IsAdmin") = True
If it's NOT then I redirect them to the login.aspx page.
Is this solution pretty solid, or is it easy to hack? I keep the password
in the web.config appsettings section so it's easy to change.
I know I could use Membership stuff, but I'm just doing a simple, quick
website.
Your thoughts are appreciated!Hello Bobby,
> I am creating a simple website with a login page and some "admin only"
> pages.
> In my login page's submit button I just say if the "password is
> correct"
> then...
> session("IsAdmin") = True
> In my admin only pages I check if session("IsAdmin") = True If it's
> NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? I keep the
> password in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple,
> quick website.
Membership is there, membership is quick and membership works out of the
box from the web.config if you need it to.
My experience is that this quick and simple website will run for the coming
20 years and that every time you need to change somthing you hoped you did
it the right way first time round...
--
Jesse Houwing
jesse.houwing at sogeti.nl
I've done the same thing in the past. There is one and only quesion
you need to ask: "is this doing what I need it to?" From your post the
answer is "yes," so you're good. But I see you're asking "is it easy
to hack?"
And the answer is a resounding "no." Session variables are stored in
the server's memory. In order to access them a hacker would need to
hack the server itself and gain access to it's memory. If that
happens, having them view your session variables would be the very
least of your concerns.
On Mar 5, 2:33=A0pm, "Bobby Edward" <t...@.test.com> wrote:
> I am creating a simple website with a login page and some "admin only"
> pages.
> In my login page's submit button I just say if the "password is correct"
> then...
> session("IsAdmin") =3D True
> In my admin only pages I check if session("IsAdmin") =3D True
> If it's NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? =A0I keep the passwo=[/color
]
rd
> in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple, quick
> website.
> Your thoughts are appreciated!
I'd look at Jesse's recommendation about using the built-in membership
system in ASP.Net 2.0 if you really want to have some flexibility. You can
then use Roles to manage your users. For administrators, you can create an
Admin role and assign the users to that role. Then all you have to do is
test if the user is in that role. Actually, better yet, you can set the
authorization section of the web.config file so that only certain users or
roles have access to particular files or folders. This let's you tweak
security in a config file without worrying about coding it in every single
page.
Hope this helps,
Mark Fitzpatrick
Microsoft MVP - Expression
"Bobby Edward" <test@.test.com> wrote in message
news:%23dULGfvfIHA.1188@.TK2MSFTNGP04.phx.gbl...
>I am creating a simple website with a login page and some "admin only"
>pages.
> In my login page's submit button I just say if the "password is correct"
> then...
> session("IsAdmin") = True
> In my admin only pages I check if session("IsAdmin") = True
> If it's NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? I keep the password
> in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple, quick
> website.
> Your thoughts are appreciated!
>
Showing posts with label login. Show all posts
Showing posts with label login. Show all posts
Thursday, March 22, 2012
Tuesday, March 13, 2012
Thread timeouts
Hi,
I have web based email management system where a user can login, create an
email and then send it to multiple recipients.
The email component I use generates all of the physical .eml files when they
click send. When a user is sending to 120, 000 recipients at once the page
times out.
I was thinking of using a separate worker thread for creating the email
messages (I dont have to worry about sending because the files get put into
a pickup directory that gets read by an SMTP component). My main concern
is - would the thread timeout at all, when trying to generate so many files?
Thanks in advance
GrahamHi Graham:
Threads do not time out, so I wouldn't have this concern.
Applications can timeout, however. I can configure an application pool in
Win2003 to shut down an app after x minutes of inactivity. A background thre
ad
isn't considered activity though - only incoming requests are. Something
to look for in your config.
Scott
http://www.OdeToCode.com/blogs/scott/
> Hi,
> I have web based email management system where a user can login,
> create an
> email and then send it to multiple recipients.
> The email component I use generates all of the physical .eml files
> when they
> click send. When a user is sending to 120, 000 recipients at once the
> page
> times out.
> I was thinking of using a separate worker thread for creating the
> email
> messages (I dont have to worry about sending because the files get put
> into
> a pickup directory that gets read by an SMTP component). My main
> concern
> is - would the thread timeout at all, when trying to generate so many
> files?
> Thanks in advance
> Graham
I have web based email management system where a user can login, create an
email and then send it to multiple recipients.
The email component I use generates all of the physical .eml files when they
click send. When a user is sending to 120, 000 recipients at once the page
times out.
I was thinking of using a separate worker thread for creating the email
messages (I dont have to worry about sending because the files get put into
a pickup directory that gets read by an SMTP component). My main concern
is - would the thread timeout at all, when trying to generate so many files?
Thanks in advance
GrahamHi Graham:
Threads do not time out, so I wouldn't have this concern.
Applications can timeout, however. I can configure an application pool in
Win2003 to shut down an app after x minutes of inactivity. A background thre
ad
isn't considered activity though - only incoming requests are. Something
to look for in your config.
Scott
http://www.OdeToCode.com/blogs/scott/
> Hi,
> I have web based email management system where a user can login,
> create an
> email and then send it to multiple recipients.
> The email component I use generates all of the physical .eml files
> when they
> click send. When a user is sending to 120, 000 recipients at once the
> page
> times out.
> I was thinking of using a separate worker thread for creating the
> messages (I dont have to worry about sending because the files get put
> into
> a pickup directory that gets read by an SMTP component). My main
> concern
> is - would the thread timeout at all, when trying to generate so many
> files?
> Thanks in advance
> Graham
Thread timeouts
Hi,
I have web based email management system where a user can login, create an
email and then send it to multiple recipients.
The email component I use generates all of the physical .eml files when they
click send. When a user is sending to 120, 000 recipients at once the page
times out.
I was thinking of using a separate worker thread for creating the email
messages (I dont have to worry about sending because the files get put into
a pickup directory that gets read by an SMTP component). My main concern
is - would the thread timeout at all, when trying to generate so many files?
I have web based email management system where a user can login, create an
email and then send it to multiple recipients.
The email component I use generates all of the physical .eml files when they
click send. When a user is sending to 120, 000 recipients at once the page
times out.
I was thinking of using a separate worker thread for creating the email
messages (I dont have to worry about sending because the files get put into
a pickup directory that gets read by an SMTP component). My main concern
is - would the thread timeout at all, when trying to generate so many files?
Thanks in advance
GrahamHi Graham:
Threads do not time out, so I wouldn't have this concern.
Applications can timeout, however. I can configure an application pool in
Win2003 to shut down an app after x minutes of inactivity. A background thread
isn't considered activity though - only incoming requests are. Something
to look for in your config.
--
Scott
http://www.OdeToCode.com/blogs/scott/
> Hi,
> I have web based email management system where a user can login,
> create an
> email and then send it to multiple recipients.
> The email component I use generates all of the physical .eml files
> when they
> click send. When a user is sending to 120, 000 recipients at once the
> page
> times out.
> I was thinking of using a separate worker thread for creating the
> email
> messages (I dont have to worry about sending because the files get put
> into
> a pickup directory that gets read by an SMTP component). My main
> concern
> is - would the thread timeout at all, when trying to generate so many
> files?
> Thanks in advance
> Graham
Thread was being aborted
Hi,
When I do the Login using the code below I am getting the
System.Thread.ThreadAbortException(Thread was being abortefd) on the last
line of the below code i.e.
Response.RedirectFormsAuthentication.GetRedirectUrluID,isPersistent));
there is no original URL, therefore it is returning Default.aspx.
I don't know why I am getting the above exception.
private void ButtonLogin_Click(object sender, System.EventArgs e)
{
string sessionID = "";
string uID = txtUsername.Text;
string pwd = txtPassword.Text;
bool isPersistent = false; try
{
ESMLoginResultEnum loginResult = ESMSecurityModule.Login(uID, pwd, out
sessionID);
string userData = sessionID;
switch(loginResult)
{
case ESMLoginResultEnum.OK:
{
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.Now,System.DateTime.Now.AddM
inutes(AUTH_TIMEOUT),isPersistent,userDa
ta,FormsAuthentication.FormsCookiePa
th);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName,encTicket);
cookie.Path = FormsAuthentication.FormsCookiePath;
// Create the cookie.
Response.Cookies.Add(cookie);
// Redirect back to original URL.
Response.Redirect(FormsAuthentication.GetRedirectUrl(uID,isPersistent));
break;
}
}
}
}
Regards,
EktaEnhar:
Response.Redirect("someUrl") always throws a threadAbort exception.
Response.Reidrect("someUrl") calls Response.Redirect("someUrl", true)
with true meaning "end the response". So Response.End() is called which
throws that exception.
If you want, you can avoid the error by doing Response.ReidrecT("someUrl",
false)
or you could swollow the exception in a try/catch
try{
Response.Redirect("someUrl")
}catch (ThreadAbortException ex){}
Karl
MY ASP.Net tutorials
http://www.openmymind.net/ - New and Improved (yes, the popup is annoying)
http://www.openmymind.net/faq.aspx - unofficial newsgroup FAQ (more to
come!)
"enahar" <enahar@.hotmail.com> wrote in message
news:e092bRsIFHA.3628@.TK2MSFTNGP15.phx.gbl...
> Hi,
> When I do the Login using the code below I am getting the
> System.Thread.ThreadAbortException(Thread was being abortefd) on the last
> line of the below code i.e.
> Response.RedirectFormsAuthentication.GetRedirectUrluID,isPersistent));
> there is no original URL, therefore it is returning Default.aspx.
>
> I don't know why I am getting the above exception.
>
>
> private void ButtonLogin_Click(object sender, System.EventArgs e)
> {
> string sessionID = "";
> string uID = txtUsername.Text;
> string pwd = txtPassword.Text;
>
> bool isPersistent = false; try
> {
> ESMLoginResultEnum loginResult = ESMSecurityModule.Login(uID, pwd, out
> sessionID);
> string userData = sessionID;
> switch(loginResult)
> {
> case ESMLoginResultEnum.OK:
> {
> FormsAuthenticationTicket ticket = new
>
FormsAuthenticationTicket(1,uID,System.DateTime.Now,System.DateTime.Now.AddM
inutes(AUTH_TIMEOUT),isPersistent,userDa
ta,FormsAuthentication.FormsCookiePa
th);
> // Encrypt the ticket.
> string encTicket = FormsAuthentication.Encrypt(ticket);
> HttpCookie cookie = new
> HttpCookie(FormsAuthentication.FormsCookieName,encTicket);
> cookie.Path = FormsAuthentication.FormsCookiePath;
> // Create the cookie.
> Response.Cookies.Add(cookie);
> // Redirect back to original URL.
> Response.Redirect(FormsAuthentication.GetRedirectUrl(uID,isPersistent));
>
> break;
> }
> }
> }
> }
>
> Regards,
> Ekta
>
>
Hi,
Session is still not timing out when there is no activity by the user for 15
minutes.
My web.config settings are as below.
also in the login page for the ticket I am adding 15 minutes.
What is wrong i am doing it..
Regards,
Ekta
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
1,
uID,
System.DateTime.Now,
System.DateTime.Now.AddMinutes(15),
isPersistent,
userData,
FormsAuthentication.FormsCookiePath);
:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
<section name="AppConfiguration" type="PIT.ESH.Common.WebConfiguration,
PITSHCommon" />
</configSections>
<system.web>
<compilation defaultLanguage="c#" debug="true" />
<customErrors mode="RemoteOnly" />
<authentication mode="Forms">
<forms loginUrl="Security/Login.aspx" protection="All" timeout="2" path="/"
/>
</authentication>
<authorization>
<deny users="?" />
</authorization>
<trace enabled="true" requestLimit="10" pageOutput="false"
traceMode="SortByTime" localOnly="true" />
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="2" />
<globalization
requestEncoding="utf-8"
responseEncoding="utf-8"
culture="en-AU"
uiCulture = "en-AU"
/>
</system.web>
<AppConfiguration>
<!-- Application Settings -->
<add key="Web.EnablePageCache" value="true" />
<add key="Web.PageCacheExpiresInSeconds" value="3600" />
<add key="Web.EnableSsl" value="False" />
<add key="DB.ConnectionString" value="Data Source=DEVTEST-SQL1;User
ID=sa;Password=;Initial Catalog=Genesis2" />
<add key="Copyright.Message" value=" 2001-04 Positive IT Solutions Pty
Ltd." />
<add key="Copyright.EMail" value="" />
</AppConfiguration>
<appSettings>
<add key="Copyright.EMail" value="Etivity@.Postitive-IT.com.au" />
</appSettings>
<system.runtime.remoting>
<application>
</application>
</system.runtime.remoting>
<location path="default.aspx">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>
<location path="Security">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>
<location path="Public">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
</configuration>
On Mon, 7 Mar 2005 17:09:01 +1100, "enahar" <enahar@.hotmail.com>
wrote:
>Hi,
>Session is still not timing out when there is no activity by the user for 1
5
>minutes.
>My web.config settings are as below.
>also in the login page for the ticket I am adding 15 minutes.
>
>What is wrong i am doing it..
>
>Regards,
>Ekta
>
Hi Etka:
Are you testing the Session timeout or the forms authentication ticket
timeout?
Scott
http://www.OdeToCode.com/blogs/scott/
I am writing the following code in the web.config file and the Login.aspx.cs
for the sessiopn TimeOut and for the forms authentication ticket timeout.
Also I am writing the following code in the Body tag of the Login.aspx page
<meta http-equiv="Refresh" URL="../Security/Login.aspx>
even then Session is still not timing out when there is no activity by the
user for 15 minutes.What is wrong I am doing it.Please suggest.
code in the session_end is as follows:
protected void Session_End(Object sender, EventArgs e)
{
FormsAuthentication.SignOut();
if (Session["SessionID"] != null)
{
try
{
ESMSecurityModule.killSession(Session["SessionID"].ToString());
}
catch
{
}
}
}
WEB.CONFIG
<authentication mode="Forms">
<forms loginUrl="../Security/Login.aspx" protection="All" timeout="15"
path="/" />
</authentication>
and for the forms authentication ticket TimeOut I am writing the following
code in the Login.aspx page:
LOGIN.ASPX PAGE
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.Now,System.DateTime.Now.AddM
inutes(15),false,userData,FormsAuthentic
ation.FormsCookiePath);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName,encTicket);
cookie.Path = FormsAuthentication.FormsCookiePath;
// Create the cookie.
Response.Cookies.Add(cookie);
// Redirect back to original URL.
Response.Redirect(FormsAuthentication.GetRedirectUrl(uID,isPersistent),false
);
Regards,
Ekta
"Scott Allen" <scott@.nospam.odetocode.com> wrote in message
news:l3vo21hihtmb3pauqj9sphjqorb7v225fk@.
4ax.com...
> On Mon, 7 Mar 2005 17:09:01 +1100, "enahar" <enahar@.hotmail.com>
> wrote:
>
> Hi Etka:
> Are you testing the Session timeout or the forms authentication ticket
> timeout?
> --
> Scott
> http://www.OdeToCode.com/blogs/scott/
>
Hi enahar:
Don't relay on the Session_End event. Have you tested by hitting the
site with the browser after over 15 minutes of inactivity?
Scott
http://www.OdeToCode.com/blogs/scott/
Yes I have tested by hitting the
site with the browser after over 15 minutes of inactivity?
Regards
Ekta
*** Sent via Developersdex http://www.examnotes.net ***
Don't just participate in USENET...get rewarded for it!
When I do the Login using the code below I am getting the
System.Thread.ThreadAbortException(Thread was being abortefd) on the last
line of the below code i.e.
Response.RedirectFormsAuthentication.GetRedirectUrluID,isPersistent));
there is no original URL, therefore it is returning Default.aspx.
I don't know why I am getting the above exception.
private void ButtonLogin_Click(object sender, System.EventArgs e)
{
string sessionID = "";
string uID = txtUsername.Text;
string pwd = txtPassword.Text;
bool isPersistent = false; try
{
ESMLoginResultEnum loginResult = ESMSecurityModule.Login(uID, pwd, out
sessionID);
string userData = sessionID;
switch(loginResult)
{
case ESMLoginResultEnum.OK:
{
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.Now,System.DateTime.Now.AddM
inutes(AUTH_TIMEOUT),isPersistent,userDa
ta,FormsAuthentication.FormsCookiePa
th);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName,encTicket);
cookie.Path = FormsAuthentication.FormsCookiePath;
// Create the cookie.
Response.Cookies.Add(cookie);
// Redirect back to original URL.
Response.Redirect(FormsAuthentication.GetRedirectUrl(uID,isPersistent));
break;
}
}
}
}
Regards,
EktaEnhar:
Response.Redirect("someUrl") always throws a threadAbort exception.
Response.Reidrect("someUrl") calls Response.Redirect("someUrl", true)
with true meaning "end the response". So Response.End() is called which
throws that exception.
If you want, you can avoid the error by doing Response.ReidrecT("someUrl",
false)
or you could swollow the exception in a try/catch
try{
Response.Redirect("someUrl")
}catch (ThreadAbortException ex){}
Karl
MY ASP.Net tutorials
http://www.openmymind.net/ - New and Improved (yes, the popup is annoying)
http://www.openmymind.net/faq.aspx - unofficial newsgroup FAQ (more to
come!)
"enahar" <enahar@.hotmail.com> wrote in message
news:e092bRsIFHA.3628@.TK2MSFTNGP15.phx.gbl...
> Hi,
> When I do the Login using the code below I am getting the
> System.Thread.ThreadAbortException(Thread was being abortefd) on the last
> line of the below code i.e.
> Response.RedirectFormsAuthentication.GetRedirectUrluID,isPersistent));
> there is no original URL, therefore it is returning Default.aspx.
>
> I don't know why I am getting the above exception.
>
>
> private void ButtonLogin_Click(object sender, System.EventArgs e)
> {
> string sessionID = "";
> string uID = txtUsername.Text;
> string pwd = txtPassword.Text;
>
> bool isPersistent = false; try
> {
> ESMLoginResultEnum loginResult = ESMSecurityModule.Login(uID, pwd, out
> sessionID);
> string userData = sessionID;
> switch(loginResult)
> {
> case ESMLoginResultEnum.OK:
> {
> FormsAuthenticationTicket ticket = new
>
FormsAuthenticationTicket(1,uID,System.DateTime.Now,System.DateTime.Now.AddM
inutes(AUTH_TIMEOUT),isPersistent,userDa
ta,FormsAuthentication.FormsCookiePa
th);
> // Encrypt the ticket.
> string encTicket = FormsAuthentication.Encrypt(ticket);
> HttpCookie cookie = new
> HttpCookie(FormsAuthentication.FormsCookieName,encTicket);
> cookie.Path = FormsAuthentication.FormsCookiePath;
> // Create the cookie.
> Response.Cookies.Add(cookie);
> // Redirect back to original URL.
> Response.Redirect(FormsAuthentication.GetRedirectUrl(uID,isPersistent));
>
> break;
> }
> }
> }
> }
>
> Regards,
> Ekta
>
>
Hi,
Session is still not timing out when there is no activity by the user for 15
minutes.
My web.config settings are as below.
also in the login page for the ticket I am adding 15 minutes.
What is wrong i am doing it..
Regards,
Ekta
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
1,
uID,
System.DateTime.Now,
System.DateTime.Now.AddMinutes(15),
isPersistent,
userData,
FormsAuthentication.FormsCookiePath);
:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
<section name="AppConfiguration" type="PIT.ESH.Common.WebConfiguration,
PITSHCommon" />
</configSections>
<system.web>
<compilation defaultLanguage="c#" debug="true" />
<customErrors mode="RemoteOnly" />
<authentication mode="Forms">
<forms loginUrl="Security/Login.aspx" protection="All" timeout="2" path="/"
/>
</authentication>
<authorization>
<deny users="?" />
</authorization>
<trace enabled="true" requestLimit="10" pageOutput="false"
traceMode="SortByTime" localOnly="true" />
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="2" />
<globalization
requestEncoding="utf-8"
responseEncoding="utf-8"
culture="en-AU"
uiCulture = "en-AU"
/>
</system.web>
<AppConfiguration>
<!-- Application Settings -->
<add key="Web.EnablePageCache" value="true" />
<add key="Web.PageCacheExpiresInSeconds" value="3600" />
<add key="Web.EnableSsl" value="False" />
<add key="DB.ConnectionString" value="Data Source=DEVTEST-SQL1;User
ID=sa;Password=;Initial Catalog=Genesis2" />
<add key="Copyright.Message" value=" 2001-04 Positive IT Solutions Pty
Ltd." />
<add key="Copyright.EMail" value="" />
</AppConfiguration>
<appSettings>
<add key="Copyright.EMail" value="Etivity@.Postitive-IT.com.au" />
</appSettings>
<system.runtime.remoting>
<application>
</application>
</system.runtime.remoting>
<location path="default.aspx">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>
<location path="Security">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>
<location path="Public">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
</configuration>
On Mon, 7 Mar 2005 17:09:01 +1100, "enahar" <enahar@.hotmail.com>
wrote:
>Hi,
>Session is still not timing out when there is no activity by the user for 1
5
>minutes.
>My web.config settings are as below.
>also in the login page for the ticket I am adding 15 minutes.
>
>What is wrong i am doing it..
>
>Regards,
>Ekta
>
Hi Etka:
Are you testing the Session timeout or the forms authentication ticket
timeout?
Scott
http://www.OdeToCode.com/blogs/scott/
I am writing the following code in the web.config file and the Login.aspx.cs
for the sessiopn TimeOut and for the forms authentication ticket timeout.
Also I am writing the following code in the Body tag of the Login.aspx page
<meta http-equiv="Refresh" URL="../Security/Login.aspx>
even then Session is still not timing out when there is no activity by the
user for 15 minutes.What is wrong I am doing it.Please suggest.
code in the session_end is as follows:
protected void Session_End(Object sender, EventArgs e)
{
FormsAuthentication.SignOut();
if (Session["SessionID"] != null)
{
try
{
ESMSecurityModule.killSession(Session["SessionID"].ToString());
}
catch
{
}
}
}
WEB.CONFIG
<authentication mode="Forms">
<forms loginUrl="../Security/Login.aspx" protection="All" timeout="15"
path="/" />
</authentication>
and for the forms authentication ticket TimeOut I am writing the following
code in the Login.aspx page:
LOGIN.ASPX PAGE
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.Now,System.DateTime.Now.AddM
inutes(15),false,userData,FormsAuthentic
ation.FormsCookiePath);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName,encTicket);
cookie.Path = FormsAuthentication.FormsCookiePath;
// Create the cookie.
Response.Cookies.Add(cookie);
// Redirect back to original URL.
Response.Redirect(FormsAuthentication.GetRedirectUrl(uID,isPersistent),false
);
Regards,
Ekta
"Scott Allen" <scott@.nospam.odetocode.com> wrote in message
news:l3vo21hihtmb3pauqj9sphjqorb7v225fk@.
4ax.com...
> On Mon, 7 Mar 2005 17:09:01 +1100, "enahar" <enahar@.hotmail.com>
> wrote:
>
> Hi Etka:
> Are you testing the Session timeout or the forms authentication ticket
> timeout?
> --
> Scott
> http://www.OdeToCode.com/blogs/scott/
>
Hi enahar:
Don't relay on the Session_End event. Have you tested by hitting the
site with the browser after over 15 minutes of inactivity?
Scott
http://www.OdeToCode.com/blogs/scott/
Yes I have tested by hitting the
site with the browser after over 15 minutes of inactivity?
Regards
Ekta
*** Sent via Developersdex http://www.examnotes.net ***
Don't just participate in USENET...get rewarded for it!
thread was being aborted
Hi, everyone
I create one application with form authentication.
When I try to run application and press login button it will redirect to default page and application run success fully, some time it will not redirect to default page .
For my application, I have to create one txt log file for error …
Sometime this error occurs when I press login button….
--------------------------
Source Code : mscorlib
Error Message : Thread was being aborted.
Stack Trace : at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort()
at System.Threading.Thread.Abort(Object stateInfo)
at System.Web.HttpResponse.End()
at System.Web.HttpResponse.Redirect(String url, Boolean endResponse)
at System.Web.HttpResponse.Redirect(String url)
at pms._default.Page_Load(Object sender, EventArgs e) in C:\Inetpub\wwwroot\aspnet\pms\default.aspx.vb:line 104
--------------------------
source code for login button is……
--------------------------
Private Sub btnAdd_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnAdd.Click
Try
singleSqlString = "SELECT emp_code,password,access_level,emp_name " & _
"FROM login_master " & _
"WHERE emp_code='" & txtEmpCode.Text & "' AND password='" & txtPassword.Text & "' " & _
"ORDER BY emp_code ASC"
objlogin.FillDataSet(singleSqlString, "login_master")
If objlogin.dtSet.Tables("login_master").Rows.Count > 0 Then
Session("LoginCode") = txtEmpCode.Text
Session("EmpName") = objlogin.dtSet.Tables("login_master").Rows(0).Item("emp_name")
Session("AccessLevel") = objlogin.dtSet.Tables("login_master").Rows(0).Item("access_level")
FormsAuthentication.RedirectFromLoginPage(txtEmpCode.Text, False)
Else
lblmsg.Text = " Employee Code or Password may be wrong. - Try Again !!"
txtEmpCode.Text = ""
txtPassword.Text = ""
End If
Catch ex As ThreadAbortException
lblmsg.Visible = True
lblmsg.Text = "Thread is aboard"
Catch ex As Exception
objlogin.CreateLogFile(ex, objlogin.Message)
End Try
End Sub
--------------------------
when I trace my application using break point exception is not generated , but error occurs
plz give any solution and cause for this error.
Thanks in advance
Hi,The error generated appears to be occuring on the default page:
at pms._default.Page_Load(Object sender, EventArgs e) in C:\Inetpub\wwwroot\aspnet\pms\default.aspx.vb:line 104
Have you checked/debugged the code here to see what's happening?Thread was being aborted
Hi,
When I do the Login using the code below I am getting the
System.Thread.ThreadAbortException(Thread was being abortefd) on the last
line of the below code i.e.
Response.RedirectFormsAuthentication.GetRedirectUr luID,isPersistent));
there is no original URL, therefore it is returning Default.aspx.
I don't know why I am getting the above exception.
private void ButtonLogin_Click(object sender, System.EventArgs e)
{
string sessionID = "";
string uID = txtUsername.Text;
string pwd = txtPassword.Text;
bool isPersistent = false; try
{
ESMLoginResultEnum loginResult = ESMSecurityModule.Login(uID, pwd, out
sessionID);
string userData = sessionID;
switch(loginResult)
{
case ESMLoginResultEnum.OK:
{
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.No w,System.DateTime.Now.AddMinutes(AUTH_TIMEOUT),isP ersistent,userData,FormsAuthentication.FormsCookie Path);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName,enc Ticket);
cookie.Path = FormsAuthentication.FormsCookiePath;
// Create the cookie.
Response.Cookies.Add(cookie);
// Redirect back to original URL.
Response.Redirect(FormsAuthentication.GetRedirectU rl(uID,isPersistent));
break;
}
}
}
}
Regards,
EktaEnhar:
Response.Redirect("someUrl") always throws a threadAbort exception.
Response.Reidrect("someUrl") calls Response.Redirect("someUrl", true)
with true meaning "end the response". So Response.End() is called which
throws that exception.
If you want, you can avoid the error by doing Response.ReidrecT("someUrl",
false)
or you could swollow the exception in a try/catch
try{
Response.Redirect("someUrl")
}catch (ThreadAbortException ex){}
Karl
--
MY ASP.Net tutorials
http://www.openmymind.net/ - New and Improved (yes, the popup is annoying)
http://www.openmymind.net/faq.aspx - unofficial newsgroup FAQ (more to
come!)
"enahar" <enahar@.hotmail.com> wrote in message
news:e092bRsIFHA.3628@.TK2MSFTNGP15.phx.gbl...
> Hi,
> When I do the Login using the code below I am getting the
> System.Thread.ThreadAbortException(Thread was being abortefd) on the last
> line of the below code i.e.
> Response.RedirectFormsAuthentication.GetRedirectUr luID,isPersistent));
> there is no original URL, therefore it is returning Default.aspx.
>
> I don't know why I am getting the above exception.
>
>
> private void ButtonLogin_Click(object sender, System.EventArgs e)
> {
> string sessionID = "";
> string uID = txtUsername.Text;
> string pwd = txtPassword.Text;
>
> bool isPersistent = false; try
> {
> ESMLoginResultEnum loginResult = ESMSecurityModule.Login(uID, pwd, out
> sessionID);
> string userData = sessionID;
> switch(loginResult)
> {
> case ESMLoginResultEnum.OK:
> {
> FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.No w,System.DateTime.Now.AddM
inutes(AUTH_TIMEOUT),isPersistent,userData,FormsAu thentication.FormsCookiePa
th);
> // Encrypt the ticket.
> string encTicket = FormsAuthentication.Encrypt(ticket);
> HttpCookie cookie = new
> HttpCookie(FormsAuthentication.FormsCookieName,enc Ticket);
> cookie.Path = FormsAuthentication.FormsCookiePath;
> // Create the cookie.
> Response.Cookies.Add(cookie);
> // Redirect back to original URL.
> Response.Redirect(FormsAuthentication.GetRedirectU rl(uID,isPersistent));
>
> break;
> }
> }
> }
> }
>
> Regards,
> Ekta
>
Hi,
Session is still not timing out when there is no activity by the user for 15
minutes.
My web.config settings are as below.
also in the login page for the ticket I am adding 15 minutes.
What is wrong i am doing it..
Regards,
Ekta
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
1,
uID,
System.DateTime.Now,
System.DateTime.Now.AddMinutes(15),
isPersistent,
userData,
FormsAuthentication.FormsCookiePath);
:
<?xml version="1.0" encoding="utf-8" ?
<configuration
<configSections
<section name="AppConfiguration" type="PIT.ESH.Common.WebConfiguration,
PITSHCommon" /
</configSections
<system.web
<compilation defaultLanguage="c#" debug="true" /
<customErrors mode="RemoteOnly" /
<authentication mode="Forms"
<forms loginUrl="Security/Login.aspx" protection="All" timeout="2" path="/"
/
</authentication
<authorization
<deny users="?" /
</authorization
<trace enabled="true" requestLimit="10" pageOutput="false"
traceMode="SortByTime" localOnly="true" /
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="2" /
<globalization
requestEncoding="utf-8"
responseEncoding="utf-8"
culture="en-AU"
uiCulture = "en-AU"
/
</system.web
<AppConfiguration
<!-- Application Settings --
<add key="Web.EnablePageCache" value="true" /
<add key="Web.PageCacheExpiresInSeconds" value="3600" /
<add key="Web.EnableSsl" value="False" /
<add key="DB.ConnectionString" value="Data Source=DEVTEST-SQL1;User
ID=sa;Password=;Initial Catalog=Genesis2" /
<add key="Copyright.Message" value=" 2001-04 Positive IT Solutions Pty
Ltd." /
<add key="Copyright.EMail" value="" /
</AppConfiguration
<appSettings
<add key="Copyright.EMail" value="Etivity@.Postitive-IT.com.au" /
</appSettings
<system.runtime.remoting
<application
</application
</system.runtime.remoting
<location path="default.aspx"
<system.web
<authorization
<allow users="?" /
</authorization
</system.web
</location
<location path="Security"
<system.web
<authorization
<allow users="?" /
</authorization
</system.web
</location
<location path="Public"
<system.web
<authorization
<allow users="*" /
</authorization
</system.web
</location
</configuration
On Mon, 7 Mar 2005 17:09:01 +1100, "enahar" <enahar@.hotmail.com>
wrote:
>Hi,
>Session is still not timing out when there is no activity by the user for 15
>minutes.
>My web.config settings are as below.
>also in the login page for the ticket I am adding 15 minutes.
>
>What is wrong i am doing it..
>
>Regards,
>Ekta
Hi Etka:
Are you testing the Session timeout or the forms authentication ticket
timeout?
--
Scott
http://www.OdeToCode.com/blogs/scott/
I am writing the following code in the web.config file and the Login.aspx.cs
for the sessiopn TimeOut and for the forms authentication ticket timeout.
Also I am writing the following code in the Body tag of the Login.aspx page
<meta http-equiv="Refresh" URL="../Security/Login.aspx
even then Session is still not timing out when there is no activity by the
user for 15 minutes.What is wrong I am doing it.Please suggest.
code in the session_end is as follows:
protected void Session_End(Object sender, EventArgs e)
{
FormsAuthentication.SignOut();
if (Session["SessionID"] != null)
{
try
{
ESMSecurityModule.killSession(Session["SessionID"].ToString());
}
catch
{
}
}
}
WEB.CONFIG
<authentication mode="Forms"
<forms loginUrl="../Security/Login.aspx" protection="All" timeout="15"
path="/" /
</authentication
and for the forms authentication ticket TimeOut I am writing the following
code in the Login.aspx page:
LOGIN.ASPX PAGE
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1,uID,System.DateTime.No w,System.DateTime.Now.AddMinutes(15),false,userDat a,FormsAuthentication.FormsCookiePath);
// Encrypt the ticket.
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName,enc Ticket);
cookie.Path = FormsAuthentication.FormsCookiePath;
// Create the cookie.
Response.Cookies.Add(cookie);
// Redirect back to original URL.
Response.Redirect(FormsAuthentication.GetRedirectU rl(uID,isPersistent),false);
Regards,
Ekta
"Scott Allen" <scott@.nospam.odetocode.com> wrote in message
news:l3vo21hihtmb3pauqj9sphjqorb7v225fk@.4ax.com...
> On Mon, 7 Mar 2005 17:09:01 +1100, "enahar" <enahar@.hotmail.com>
> wrote:
>>Hi,
>>
>>Session is still not timing out when there is no activity by the user for
>>15
>>minutes.
>>
>>My web.config settings are as below.
>>also in the login page for the ticket I am adding 15 minutes.
>>
>>
>>What is wrong i am doing it..
>>
>>
>>Regards,
>>Ekta
>>
>>
> Hi Etka:
> Are you testing the Session timeout or the forms authentication ticket
> timeout?
> --
> Scott
> http://www.OdeToCode.com/blogs/scott/
Hi enahar:
Don't relay on the Session_End event. Have you tested by hitting the
site with the browser after over 15 minutes of inactivity?
--
Scott
http://www.OdeToCode.com/blogs/scott/
Yes I have tested by hitting the
site with the browser after over 15 minutes of inactivity?
Regards
Ekta
*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!
Thread was being aborted
Hi,
I have a login page, and after i validate a username and password i use a
response.redirect to the default page. The username and password are stored
in an sql db. In the response.redirect i use some session variables to be
added in the query string. However i am getting a "Thread was being
aborted.". Any ideas why this could happen?
Thanks inadvance.hi
You should not include the code "Response.redirect.. " in the code blok
"Try {} catch{}"
Sample:
try
{
//deal with the login logic
}
catch(Exception e)
{
}
Response.redirect("default.aspx");
Thanks a lot, it worked. But out of curiosity, you know why the error was
raised' what goes through the try-catch block that raised that error?
"Solo" <sunsolo@.gmail.com> wrote in message
news:1125819246.425176.236590@.z14g2000cwz.googlegroups.com...
> hi
> You should not include the code "Response.redirect.. " in the code blok
> "Try {} catch{}"
> Sample:
> try
> {
> //deal with the login logic
> }
> catch(Exception e)
> {
> }
> Response.redirect("default.aspx");
>
"Loui Mercieca" <loui@.destiny-creations.com> wrote in message
news:%23p3c7USsFHA.1132@.TK2MSFTNGP10.phx.gbl...
> Thanks a lot, it worked. But out of curiosity, you know why the error was
> raised' what goes through the try-catch block that raised that error?
It's a fairly common "gotcha". If you'd written:
Response.Redirect("default.aspx", false);
you wouldn't have got the error...
Loui,
this is what happens:
"The Response.End method ends the page execution and shifts the execution to
the Application_EndRequest event in the application's event pipeline. The
line of code that follows Response.End is not executed.
This problem occurs in the Response.Redirect and Server.Transfer methods
because both methods call Response.End internally. "
This behavior is by design. You can read about it in
http://support.microsoft.com/default.aspx?scid=kb;[LN];312629
Does this information help you?
Daniel Walzenbach
"Loui Mercieca" <loui@.destiny-creations.com> schrieb im Newsbeitrag
news:OvrjmBSsFHA.3504@.TK2MSFTNGP10.phx.gbl...
> Hi,
> I have a login page, and after i validate a username and password i use a
> response.redirect to the default page. The username and password are
> stored in an sql db. In the response.redirect i use some session variables
> to be added in the query string. However i am getting a "Thread was being
> aborted.". Any ideas why this could happen?
> Thanks inadvance.
>
I have a login page, and after i validate a username and password i use a
response.redirect to the default page. The username and password are stored
in an sql db. In the response.redirect i use some session variables to be
added in the query string. However i am getting a "Thread was being
aborted.". Any ideas why this could happen?
Thanks inadvance.hi
You should not include the code "Response.redirect.. " in the code blok
"Try {} catch{}"
Sample:
try
{
//deal with the login logic
}
catch(Exception e)
{
}
Response.redirect("default.aspx");
Thanks a lot, it worked. But out of curiosity, you know why the error was
raised' what goes through the try-catch block that raised that error?
"Solo" <sunsolo@.gmail.com> wrote in message
news:1125819246.425176.236590@.z14g2000cwz.googlegroups.com...
> hi
> You should not include the code "Response.redirect.. " in the code blok
> "Try {} catch{}"
> Sample:
> try
> {
> //deal with the login logic
> }
> catch(Exception e)
> {
> }
> Response.redirect("default.aspx");
>
"Loui Mercieca" <loui@.destiny-creations.com> wrote in message
news:%23p3c7USsFHA.1132@.TK2MSFTNGP10.phx.gbl...
> Thanks a lot, it worked. But out of curiosity, you know why the error was
> raised' what goes through the try-catch block that raised that error?
It's a fairly common "gotcha". If you'd written:
Response.Redirect("default.aspx", false);
you wouldn't have got the error...
Loui,
this is what happens:
"The Response.End method ends the page execution and shifts the execution to
the Application_EndRequest event in the application's event pipeline. The
line of code that follows Response.End is not executed.
This problem occurs in the Response.Redirect and Server.Transfer methods
because both methods call Response.End internally. "
This behavior is by design. You can read about it in
http://support.microsoft.com/default.aspx?scid=kb;[LN];312629
Does this information help you?
Daniel Walzenbach
"Loui Mercieca" <loui@.destiny-creations.com> schrieb im Newsbeitrag
news:OvrjmBSsFHA.3504@.TK2MSFTNGP10.phx.gbl...
> Hi,
> I have a login page, and after i validate a username and password i use a
> response.redirect to the default page. The username and password are
> stored in an sql db. In the response.redirect i use some session variables
> to be added in the query string. However i am getting a "Thread was being
> aborted.". Any ideas why this could happen?
> Thanks inadvance.
>
Subscribe to:
Posts (Atom)