User Validation Authentication Using Session In ASP.NET

This post explains how to use User Validation Authentication Using Session In ASP.NET to validate users, Consider a scenario where you don't want to use membership class or Form Authentication techniques provided by .NET 2.0, in those situation this example might be helpful

In this example i m showing how to validate a user across different pages whether user is logged in or not using session variables in Global.asax through Session_Start event and Application_OnPostRequestHandlerExecute event which checks for the login validation which occurs when an asp.net event handler finish execution

For Forms Authentication, read this Forms Authentication with C# and managing folder lavel access with multiple web.config files in ASP.NET

Here is my login page, i've used hard coded values to login

<div style="text-align:left">

<table width="40%" style="text-align: center">

<tr><td style="width: 20%">

<asp:Label ID="lblUserName" runat="server" Text="Enter UserName:"/></td>

<td style="width: 20%">

<asp:TextBox ID="txtUserName" runat="server"/></td></tr>

<tr><td style="width: 20%">

<asp:Label ID="lblPassword" runat="server" Text="Enter Password:"/></td>

<td style="width: 20%" >

<asp:TextBox ID="txtPassword" runat="server" TextMode="Password"/></td>

</tr><tr>

<td colspan="2" align="right">

<asp:Button ID="btnLogin" runat="server" Text="Sign in" OnClick="btnLogin_Click"/>

</td></tr></table>

<asp:Label ID="Label1" runat="server" Text="Label"/><br />

</div>

After checking the username and password i m creating a new Session variable and setting the flag kindaa value in it , which is "Yes" in this example, this session value will be checked when ever user go to other pages and if it's null than user in not logged in

---

protected void btnLogin_Click(object sender, EventArgs e)
{
if (txtUserName.Text == "amit" && txtPassword.Text == "amit")
{
Session["Authenticate"] = "Yes";
Response.Redirect("Default2.aspx");
}
else
Label1.Text = " login failed";
}

In Global.asax, in Session_Start event i m assigning null value to the session variable created at the time of Login and than calling the method to check the login, same is in Application_OnPostRequestHandlerExecute event as well

---

void Session_Start(object sender, EventArgs e)
{
// Code that runs when a new session is started
Session["Authenticate"] = "";
CheckLogin();

}
void Application_OnPostRequestHandlerExecute()
{
CheckLogin();
}

void CheckLogin()
{
string Url = Request.RawUrl;
int count = Url.Length - 10 ;
string TestUrl = Url.Substring(count);
string SessionData = Session["Authenticate"].ToString();
if (SessionData == "" && TestUrl != "Login.aspx")
{
Response.Redirect("~/Login.aspx");
}
}