Restrict member-area access in Classic ASP

A member area should check authentication before protected content is rendered. A small include file makes the same Session check reusable across many ASP pages.

Include the access check

<!-- #include file="check.asp" -->

Put the include before protected page output.

Example check.asp

<%
If IsEmpty(Session("userid")) Then
  Response.Redirect "../lg-login.php"
End If
%>

The Session variable is only one part of authorization. For applications with roles or permissions, check those permissions on every protected operation rather than assuming that being logged in grants access to everything.

Use HTTPS so the authentication cookie is not exposed in transit, and provide an explicit logout action that abandons the Session.

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: