ASP redirects and HTTP referers

I'm creating an intranet application using ASP and Access. Until they have logged in, if users request any other page in the application, they are redirected to the login page. After they log in, I would like to redirect them back to the page they originally requested.

I tried using Request.ServerVariables("HTTP_REFERER") to capture the URL of the page they had originally requested, but it returns the URL for the page they were on when they made the request, not for the page they requested (which redirected them to the login page). Is there a way to capture the URL of the page which redirected them to the login page?

Is there a better way to do this?

hey mdg welcome to the devarticles forum!!

so, if I was not logged in to your website, and clicked say "membersarea.asp" it would redirect me to the login.asp page.....

what you could do is pass a variable called "referringpage" over with the redirect to login.asp.

so the code might look like:

IF user is not logged in THEN
response.redirect ("login.asp?referringpage=membersarea.asp")
END IF

then in your login.asp page, you would have the login script, and if all is ok with the username and password, you would simply get the referring page, and redirect the user back to it.


IF login is ok THEN
response.redirect "" & request.querystring("referringpage") & ""
END IF

that should work ok. So the above statement would then redirect the user to the referring page, in this case "membersareas.asp".

Hope that helps!

Another idea would be to use a session variable. If the session variable = "" then the person isn't logged in and you redirect them to login.asp

For example:

When logging in set a unique id in the database to
Session("yoursession") = db_uniqueID

Then just look for it all the time using a script at the top of the page.

If Session("yoursession") = "" Then
Response.Redirect "login.asp"
End If

hth,

yeah, that's what I do as well.. once I've validated that the user is ok.... I set the following:

// security = 1 means they are logged in. otherwise it's 0
Session("securityOK") = 1
Session("fname") = first name from the DB of the user logged in.

I use the fname variable so that I dont need to keep accessing the DB to say "hello <% fname %>"


Like adurstew said, it's then dead simple to check if a user has access to a page!

If you want to get really lazy (like me) then you write an asp page that does the Session OK check and just setup an include file on all the rest of the pages.

Then if you need to update the Session checking you only have to update the one file...

Laziness tends to be where good ideas come from...heh...

hth,

Thanks so much, these are really good ideas.

glad i could help )