This is a well known gotcha in ASP.NET 2.
User A tries to go to page XX but is not authorised to view it, because not logged in.
Gets sent to login page, logs in ok, gets sent back to page XX. Happy bunny.
User B tries to go to page XX but is not authorised to view it. B is already logged in, but not in the role required to view page XX.
Gets sent to login page. Logs in again as B, gets sent back to page XX. Still not in the role required to view page XX, gets sent back to login page.
User B tells everybody your site is broken, the login control doesn't work.
The fix is to intercept authorised users on arrival at the login page, and check to see if the returnurl is set.
If so, send them to a "Sorry, you are not allowed to view that page".
If not (ie, not logged in, or logged in but without a returnurl, which means they came here by choice) let them login.
Here is the code you need for your login page. You can cook up your own Unauthorised.aspx.
protected void Page_Load(object sender, EventArgs e)
{
if (!Page.IsPostBack)
{
if (Request.IsAuthenticated && !string.IsNullOrEmpty(Request.QueryString["ReturnUrl"]))
// This is an unauthorized, authenticated request...
Response.Redirect(
"~/Unauthorised.aspx");
}
}
If a post helps to solve your problem, please click the Answer button on that post.
I'm still confused, but now I'm confused on a higher plane.