In order to use authentication, you first need to define which pages need authentication. You accomplish this with the <authorization> tag in Web.config. In IBuySpy Store, we have three pages that need authorization: OrderList.aspx, OrderDetails.aspx, and CheckOut.aspx. Since a random user might be logged in to a temporary account, we can't let that user checkout items and pay, see the history of the orders, or examine the details of the orders. Here are the definitions of these three files in Web.config:

  <location path="Checkout.aspx">
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>
  <location path="OrderList.aspx">
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>
  <location path="OrderDetails.aspx">
    <system.web>
      <authorization>
        <deny users="?" />
	      </authorization>
    </system.web>
  </location>

  <system.web>
    <authentication mode="Forms">
      <forms name="IBuySpyStoreAuth" loginUrl="login.aspx" protection="All" path="/" />
    </authentication>
  </system.web>

  FormsAuthentication.RedirectFromLoginPage(customerId, RememberLogin.Checked);

  FormsAuthentication.SetAuthCookie(customerId, false);

People who read this tip also read these tips:

• Handling the result Object
• Using final
• The Object Class
• Polymorphic ToString()
• Reading Entity Declarations with the Browser