ASP secure user login in different access level and restricted access pages

Im building an ASP website with user login. Does any one knows what is开发者_JAVA技巧 the best and must secure way to make login page and make pages restricted access? I know some ways and used them for some website but sometimes they were not that secure. There is couple access level for this website. Admin, User, Sales Team, and couple more. Thanks.

---

you can use session variables to store user level and then on asp code define what user can or can not see. Or in database, I assume, you have field where level of access is defined as well. Basically make your security level part of SQL query and show only data user should be able to see.

Basically you should have level of access in database, login page verify credentials and then store user level in session variable. On any given page, while header loads, ASP retrives session variable and compare it to database.

If user have clearance to see that data he will if not-- display message that he is not authorized or redirect somewhere else where he can be.

---

Add an include file at the top of your ASP pages which is executed before any of the page's code. This way you can write your security code once, and apply it to all of your pages.

---

Assuming you are using IIS as your web server, you can let it handle your website security by using the different available authentication methods.

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/9b619620-4f88-488b-8243-e6bc7caf61ad.mspx?mfr=true

http://www.authenticationtutorial.com/tutorial/

Perhaps the best authentication method for you would be Windows Integrated Authentication since it allows you to create groups (or maybe use the existing ones) to give access to certain directories or pages.