4GuysFromRolla.com - All this and it counts as work!
ASP Articles Web Technology Message Board
Search 4Guys! Web Chat
ASPFAQs.com Feedback

Please Support Our Sponsors!
Site Index
  -Recent Articles
  -All Articles | ASP.NET Articles
  -ASP Coding Tips
  -ASP F.A.Q. | ASPFAQs.com
  -ASP Internet Resource
  -Related Web Technologies
  -Search
  -User Tips!

Please Visit our Partners
Where does it hurt?
FileTransfers
Excel Reports & Charts
Transactional File Mgt.
System Administration
Scalability or All Over
Check out SoftArtisans

Got PDF?


Search
Search the Site

Resources
Sections:
  -Book Reviews | Sample Chapters
  -Commonly Asked MessageBoard Questions
  -Headlines from ASPWire.com
  -JavaScript Tutorials
  -Live WebChat!
  -Newsletter
  -Official Docs
  -Security
  -Stump the SQL Guru!
  -Web Message Board
  -XML

Columnists:
  -Bart Silverstein
  -Christopher Miller
  -Ian Stallings
  -Julian Sitkewich
  -Mike Shaffer
  -Nannette Thacker
  -Ryan S.

Information:
  -Advertise
  -Feedback
  -Author an Article
  -Link to 4Guys!
  -Thanks to...

Most Viewed Pages
1. ASPFAQs.com
2. Learn More about ASP.NET
3. ASP Internet Resource
4. ASP FAQ
5. ASP Coding Tips
6. On-line Sample Chapters
7. XML Article Index
8. Creating an HTML Table with Orderable Columns
9. Passing Arrays Between the Browser and an ASP Page
10. Authentication Methods in IIS

Web Technology [Search]
Share this Article with a Friend! Print this Page!
Logins and Permissions
By Peter McMahon


The Problem
I was approached to build a financial tracking system for the company I work for during December of 1999. This system would allow the financial people and managers to login, view all the data, and modify it. The employees would be able to login and see what they would be owed for the month (employees are paid on a commission basis). They would only be allowed to see what they were earning, not what anyone else was earning. It was imperative that the data could not be tampered with if someone simply knew the names of the files where the data could be edited, so login state had to be kept. The admin users also needed to be able to add, delete, and modify users.

SSL
SSL, or Secure Socket Layers (denoted by URLs that start with https://) should play a very large role in the security mechanisms of your site if you are serious about security. SSL allows information to be transferred securely over the Internet between two parties using a public-key/private-key authentication method to ensure the identity of both parties (you can read more about how SSL works by reading the articles in the Security Section). If the information that you will be transferring is sensitive (such as financial information), then I strongly recommend that you integrate SSL into your security mechanisms. Most important is the user login form. This is a bare minimum as to what should be protected using SSL, as should someone gain usernames and passwords to the site, you have a very serious security breach.

Database Design
The first thing I do when I receive a project like this is take out a piece of paper and work out what tables and columns I'm going to need in the database. Following that, I load up MS Access and design my tables. Below is the Logins table for this project:

The Logins database table.

Obviously, the Logins table would require a Username and a Password column, however I decided on also adding a third column, Status, which would be used to determine the permissions of any particular user. For example, a user with the status of "Administrator" would be able to view all of the financial documents, whereas a user with the status of "Designer" would only be able to see their financial information.

The Solution
The first page that needs to be created is the login form. I developed a standard form in an HTML file, login.html:

<HTML>
<HEAD>
<TITLE>Login</TITLE>
</HEAD>
<BODY>
<FORM ACTION="login.asp" METHOD="post">
<TABLE BORDER="0">
<TR>
   <TD VALIGN="Top">Username:</TD>
   <TD VALIGN="Top"><INPUT TYPE="text" NAME="txtUsername"></TD>
</TR>
<TR>
   <TD VALIGN="Top">Password:</TD>
   <TD VALIGN="Top"><INPUT TYPE="password" NAME="txtPassword"></TD>
</TR>
<TR>
   <TD VALIGN="Top"></TD>
   <TD VALIGN="Top"><INPUT TYPE="submit" VALUE="Login"></TD>
</TR>
</TABLE>
</FORM>
</BODY>
</HTML>

It is important that you use the HTTP POST method to send the login data, not GET, as users would be able to see passwords in the client's browser history, amongst other things that would pose a security threat.

The next file that needs to be created is login.asp, which will process the login information and set the login state. Here's the basic idea of how the code works:

  • Load entries from the database Logins table where the Username column is equal to the inputted user name.
  • If the returned Recordset is empty (EOF is True), the user name does not exist. Report an error.
  • If the returned recordset isn't empty, the user name exists. Check the current record's password against the inputted one.
  • If they do not match, the password is incorrect. Report an error.
  • If they do match, the password is correct. Set a session variable to store the state of the user.

Here's the code used:

<%
   Response.Buffer = True
   Dim objConn, objRS
   Session.Contents("status") = ""
   Set objConn = Server.CreateObject("ADODB.Connection")
   objConn.Open "DSN=LoginTest;"
   Set objRS = objConn.Execute("SELECT * FROM Logins WHERE Username = '" & _
      Request.Form("txtUsername") & "'")
   If Not objRS.EOF Then
      If objRS(1) = Request.Form("txtPassword") Then
         Session.Contents("status") = objRS(2)
         Response.Redirect "menu.asp"
      Else
      End If
   Else
      Response.Write "Sorry, but the username does not exist."
   End If
   objRS.Close
   Set objRS = Nothing
   objConn.Close
   Set objConn = Nothing
%>

The script is fairly basic and simply opens a database, requests a recordset, checks to see if it's empty or not using the EOF property (which is true if the recordset is empty), returns errors if appropriate, and redirects the browser if required. The next page that requires attention is menu.asp that the user is redirected to once they have successfully logged in. We'll discuss the menu in Part 2!

  • Read Part 2

  • Please Support Our Sponsors!


    Powered by XCache

    Web Technology | Web Messageboard | WebChat! | Link to Us | Advertise | Feedback | ASPFAQs | Awards | Thanks to... | Legal