I'm using WebForms and Asp.Net Routing.
When trying to implement security on a members folder, I'm following the directions here :
http://blogs.msdn.com/b/mikeormond/archive/2008/06/21/asp-net-routing-and-authorization.aspx
private IHttpHandler GeneratePage(string VN, RequestContext RC)
{
string virtualPath
= string.Format("~/Members/{0}.aspx", VN);
if (UrlAuthorizationModule.CheckUrlAccessForPrincipal(virtualPath,
RC.HttpContext.User,
RC.HttpContext.Request.HttpMethod))
{
if (virtualPath != null)
{
return (Page)BuildManager.CreateInstanceFromVirtualPath(virtualPath, typeof(Page));
}
}
else
{
throw new SecurityException();
}
return null;
}
}
H开发者_JAVA技巧owever, I don't just want to throw a security Exception, I would like to redirect to the login page. I'd rather not hard-code a Response.Redirect
and I don't think this is the right way to do it anyhow.
What's the "proper" way to pass control to the Authorization engine and redirect to the Default Login page?
You can't have both.
Thowing an exception terminates the code path.
Alternatively you can call
FormsAuthentication.RedirectToLoginPage(string extraQueryString)
and pass an arg that lets you inform the user of the problem on the login page.
e.g.
FormsAuthentication.RedirectToLoginPage("error=authorization-failure")
You would, of course, need to write code in the login page to recognize this.
精彩评论