workaround for password protection

**Soquili** · 17 December 2011, 04:35 PM

Megg the attached .web creates a two page website that works on my local IIS7 test server. I used Web Designer 6 to create the .web so it should load without any problems on your system.

Two things to remember when using the Microsoft code to help protect some asp pages:
1. Name the first page logon.asp, it will export as logon.html but you must rename it to have the .asp suffix rather than .htm or html.
2. The placeholder for the second and/or subsequent pages must be named <html> so the code is added to the beginning of the file before any html. The code redirects browsers to the logon.asp page if the user is not validated.

BTW I tested the pages using IE, FireFox, Opera, Safari, and Chrome browsers and all work correctly.

The Microsoft code is a primitive method to protect your pages and can be circumvented by someone with knowledge and a desire to do so.

**Megg81** · 18 December 2011, 11:36 AM

Hi Soquili, thanks so much for the file above. I've inserted the placeholders in the pages - though when inserted onto the index page it causes the page to left align in preview. Is there a reason for this or could you advise how to correct?

**Soquili** · 18 December 2011, 11:04 PM

Megg which placeholder are you referring to?

**Megg81** · 19 December 2011, 02:08 PM

Ok, I've spent some more time on it this afternoon and have two problems which I cant seem to resolve.

With the placeholder named <html> on the index page the page becomes left aligned in preview and when live. Removing the name of the placeholder but leaving in the code, the page is centred again. The code I have for the placeholder on the index page is:
<%
Validated = "OK"
if Request.Cookies("ValidUser") <> Validated then
'Construct the URL for the current page.
dim s
s = "http://"
s = s & Request.ServerVariables("HTTP_HOST")
s = s & Request.ServerVariables("URL")
if Request.QueryString.Count > 0 THEN
s = s & "?" & Request.QueryString
end if
'Redirect unauthorized users to the logon page.
Response.Redirect "Logon.asp?from=" &Server.URLEncode(s)
End if
%>

The other problem is that the page index.asp won't load. I receive Error 500 "500 - Internal server error. There is a problem with the resource you are looking for, and it cannot be displayed." Before the page is renamed (and it is still named index.htm) it will load, once named index.asp it will not load.

I've inserted a page at the top of my file named asp - as advised this remains as asp.htm. Below this is the logon page (logon.asp). Below this is the index page (index.asp) then contact.htm, about.htm & services.htm. The latter three may need to have the code inserted too to password protect, but for now Im just trying to get the index page to work. I've been exporting all the files from WD6 as normal then in my file manager on the hosting I've been renaming the files to get the .asp file extension once on the server. I've changed the code on the logon page to point to index.asp instead of "MyPage.asp" as in the example and changed the user name and password. That's all, otherwise it remains as provided on the weblink I posted above.

Any suggestions on a solution? I have a feeling its probably something quite obvious to someone who has experience.

**Megg81** · 19 December 2011, 06:21 PM

I've now inserted the code into the other 3 pages on the site (contact, about & services) and renamed the file extensions to .asp. While these pages do load (index.asp still will not load) there is no redirection to the logon page on accessing them. Any of the pages which have the above code inserted in a placeholder named <html> are left aligned, if the placeholder is named <head> or <body> then the page remains centered.

**Soquili** · 20 December 2011, 05:54 AM

Megg did you create a file named logon.asp or are you using your index file for the login form?

If you are using index.asp as the login form you will need to change the redirect code by changing logon.asp to index.asp.

I will do some research tomorrow as to why the <html> placeholder is causing the left alignment. Using <head> or <body> as the placeholder name will not put the code where it needs to be to secure your pages.

Sorry I cannot do the research tonight, it was a difficult day at work and then I needed to do some repairs on my house plumbing once I returned home.

**Megg81** · 20 December 2011, 07:13 AM

Thanks Soquili - hope your repairs are nothing too serious, esp not in Christmas week!

Yes I have a page named logon.asp where the username & password are requested ahead of the index page. Here's how my site looks at mo once exported and renamed:

asp.htm
logon.asp
index.asp
services.asp
contact_us.asp
about.asp

just that going to servies, contact_us or about there's no redirection to the logon page as there should be and index won't load at all, returns internal server error 500 although it has the exact same code as the other 3 pages which do load but don't work. Im sure I must be doing something wrong

Work again now though...

**Soquili** · 20 December 2011, 02:49 PM

Megg would you mind posting your .web file?

If you would prefer not to post it, you can email it to bjt49 [at] hotmail.com.

Without your file it is a bit like playing darts with a blindfold inside an unlit coal mine. No way of knowing where to begin.

**Megg81** · 20 December 2011, 03:10 PM

Hi Soquili, I'l just have a couple of last shots before I send the file. I've uploaded the example which you posted earlier in this thread onto my server and I've got that working once I renamed the logon.htm to logon.asp - but when I exported from WD6 the page titled MyPage already had the .asp file extension and so didnt need changing. How did you do this? Im having to rename all my files once they're on the server. Perhaps this is making a difference.

EDIT: I just figured out how to do that. simply rename as pagename.asp in xara before export...

**Soquili** · 20 December 2011, 03:18 PM

Hi Megg,

When exporting the website I named the first page with .asp extension which is used for all other pages of the site, but unfortunately Web Designer is hard coded to always use .htm (.html) for the first page so it overwrites the .asp so it must be renamed after the export.

Renaming the files on the server would not change how they behave. There may be some bit of html code or javascript that is causing the problem you are seeing.