keepfatinmind:can you please give me a example for creat a class for store user info?
I also wondering is it ok if I use Session to pass the loging ID for each pages?
thank you
When a authorised user loggs in, a session is created. This session is used for discriminating beetween authenticated and non authenticated users on every page. On the page load, this session check is done. If the session check is failed, you redirect the user to home page or a similar page using Responce.Redirect() method. This keeps non authenticated users to keep away from sensitive data.
If you are using sessions, you do not pass session information to every page, that information exists, you just retrieve this information when needed, and it is absolutely safe.
Example:
1) Create a session:
Session["id"] = rd.GetString(0); // Where rd.getstring(0) retrieves your user id from database.
2) Evaluate a session for authorized data access:
if (Session["status"] == null) // Session remains null if user directly types url of the page without logging in first.
{
Response.Redirect("default.aspx");
}
else
{
if (Session["status"].ToString() != "manager") // to check if logged in user has proper rights or not. This section can be modified in many ways.
{
Response.Redirect("default.aspx");
}
}
It is very important to create sessions and authenticate them for a website.
Regarding your IP tracing, you must know that today most of ISP provides dynamic IP to their subscribers. IP changes everytime the user reconnects to internet. You will not be able to trace your users this way. Using Sessions and making an entry in DB @ time of login or logout of User Id is the best idea!!