Restrict URL to specific database username ASP.NET

user_12628376 0
Viewed 104

I am making a website tool isch with ASP.NET Framework, that lets a user/customer preview their website.

I have a simple database that gathers a SESSION["username"] and creates a with the source to the customer project file.

But if I have multiple users how am I supposed to prevent users from accessing each other's files using the URL? like if the directory for the customer projects is ? "~/Customer/SESSION["username"]/Default.aspx and user1 enters user2 in the directory instead. I will post some content of the page here to make it easier to understand.

Directory of my project

Directory of my project

In the Default.aspx page I direct everyone that is not the user "admin". And inside the Default.aspx i have an IFrame that looks like this <iframe id="contentPanel1" runat="server" /> and it gets its src attribute from my Default.aspx.cs that looks like this:

using System;
using System.Web.UI;


namespace MyFeedbackWebsite
{
    public partial class _Default : Page
    {

        protected void Page_Load(object sender, EventArgs e)
        {

            

            if (Session["username"] == null)
            {
                Response.Redirect("~/login");
            }

            if ((string)Session["username"] == "admin")
            {
                Response.Redirect("~/admin");
            }

            this.contentPanel1.Attributes["src"] = "https://localhost:44350/Customer/"  + Session["username"].ToString();
        }
    }


}

In my Admin.aspx.cs I check if the username = admin and if the user is logged in:

using System;

namespace MyFeedbackWebsite
{
    public partial class admin : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            if ((string)Session["username"] == null)
            {
                Response.Redirect("~/Login");
            }

            if ((string)Session["username"] != "admin")
            {
                Response.Redirect("~/Default");
            }
        }
    }
}

And in the /Customer/ Directory I want the customers project to be located. But as I mentioned, if the directory is /Customer/user1/Default.aspxI want the user1 value to match the current session. Thanks beforehand!

Best regards Max

mysql html .net c#
1 Answers

A few observations

Now, I don't know the background of this project you're working on, but it seems you are relatively new to some of the concepts, so I'll just list a few things for you to think about:

  • If this is a new project I would highly recommend you to stop and instead look at ASP.NET Core or similar. .NET Framework is slowly being replaced by .NET Core, so a new project based on .NET Framework (such as ASP.NET Web Forms) will quickly become outdated (if it isn't already from the start).
  • If this is just a spare time/personal little project, all good (except for above point) - playing around with it is a good way to learn. If it's a commercial or otherwise serious project, however, I would recommend you to read up on security best practices in web applications. Restricting access to a page using a construct like Session["username"] != "admin" is bad business and very error prone. Take a look here for an example of configuring which users or roles can access which pages.

The problem in question

It's still a little unclear to me what part of your code handles/is run when accessing /Customer/user1/Default.aspx. But I would recommend you, that instead of having the username be part of the URL, you are getting the username from the session in the backend instead, and then serving the proper page matching that username:

  1. User accesses the URL /Customer/Default.aspx
  2. Backend verifies that user is logged in. If not, user is redirected to login page
  3. Backend gets the username from the session and returns the page <username>/Default.aspx (note: this is not a URL, but a file path or something similar that points to the page you are serving - the user never sees this)

Now, the user will not be able to see another user's page because /Customer/user1/Default.aspx is not a valid URL - /Customer/Default.aspx is.

user_30342730
Related