Then, on subsequent pages, I'm checking for the cookie, and redirecting if it's not there:
<%@ Language=VBScript %>
<%
If NOT request.cookies("user") = "authenticated" Then
response.redirect "http://somepage"
End If
%>
What I need to do is incorporate an ignore element (by user-agent or IP) into where it checks for the cookie. For instance, if a user has an IP of 127.0.0.1, it ignores whether they have the cookie or not and lets them view the page.
The reason I'm doing this is I have a search engine that's crawling the site and it doesn't always go through the front page - therefore, it's getting redirected on most of the pages it sees. So what I'd like to do is have the script see that user-agent or IP, then ignore the cookie requirement.
We have a company intranet based on ASP (Win2k, IIS 5.0, SQLServer 7.0). For security purpose, my boss wants to block some employees from logging in to our intranet except for from our factory. Our factory has a SBC DSL (one dynamic IP and it's shared). I know how to get the client pc's IP address. But as the IP address is dynamic, I cannot depend on it.
Is there a way that I can detect the user is accessing from our factory (like router's MAC address)? One way I brought up is making a page to record the client computer's ip and making one of our factory's computers automatically call the page. But this scheme is incomplete as you know.
How do I get the User-Agent?I searched but didn't find anything. The reason I am asking is because I have a php script which accesses an ASP script via PHP:cURL for legacy reasons. I want it so that if the User-Agent matches what the php script sends, the asp should take a slightly different action.
I am trying to change the useragent in asp.I come in to that page using a user agent : something i want to change it to somethinganything..can it be done using asp.
Is there a fast way, with Classic ASP, to determine if a user agent is a search engine spider?
I know that ASP.NET has Request.Browser.Crawler, I'm looking to see if classic ASP has something built in, or do I have to look for strings in the user agent.
I need to be able to execute some code or display a popup when a user leaves the site. Does anyone know if it is possible to detect this? Is there an event that is called before the user leaves where I could put some code?
Is it possible for a user to enable permanent cookies but disable session cookies.....this seems like a contradition yet this is what I appear to be reading in online articles?
My web application uses a custom-generated menu system which is tailored for each user individually when they log in, based on their permissions. I've got this working very quickly on the server using ASP, and the menus are just included into each page as it's served out.
The problem is that the menus take up a fair amount of bandwidth (about 12 seconds over 28.8 modem - not an uncommon dial-up speed in this part of the world). I can't really simplify the menus any further, so the only thing left to me is to somehow cache the menus on the client, but I can't figure out a way to do it.I've thought about getting the asp menu builder program to write out the menu item data to a .js script file and then build the menus on the client using the cached .js file, but this is clumsy, and if the user's machine is low-spec it could take longer to build the menus than download them.
I want to redirect users who DO NOT SUPPORT sessions to another page.
Think this will work? PSEUDO CODE:
------------------------------------------------------------------- <asp vbscript> <session("test")="true"> <if session("test")="true" then do nothing else response.redirect(www.domain.com/nosessions) end if> -------------------------------------------------------------------
This is setting a session state of "true", and I presume if sessions are disabled for security reasons, that the site will redirect accordingly?
I want to create directory and set access permission to specific user.
i tried with wscript but it's not working, i used "cacls" command it's working only NTFS partition but i used to fat32 . how to set directory permission with asp script on fat32 so anyone help me?
Is there a way to make cookies unique for each user logging into an asp application without overwriting the original cookie?
For example:
User A logs in as User A. A cookie is created on that users computer with name, user_id, etc. Then User A logs in as User B - while still logged into User A.
How do I prevent the original cookie from being overwritten? Or should that first cookie be overwritten?
USER AUTHENTICATION (LOGIN/LOGOUT procedure) When the user LOGS IN his user name, access rights and other user-related information is stored into Session variables
when the user LOGS OUT (or the session expires) this information is discarded
Session("access") = "" Session("login") = ""
NOTE: I do NOT use IP address for user authentication.
PROBLEM:
After the first user logs in to my site, any other user (different PC behind that NAT) that opens internet browser (MSIE) and visits my site is ALREADY logged in as the first user!
It seems that the problem is only restricted to users that are "hidden" behind single IP address (using NAT). The logging works perfectly for any not behind NAT user. It acts as if only one cookie file was created for all users that access my site from behid NAT; as if the cookie was created on the NAT router and not directly on client's computer.
I need some help regarding cookies and session objects and also global.asa file
I am creating one cookie when a user logs in on my website. The cookie stores the login name of the user. I want that cookie should get deleted when user closes the browser without signing out.
I think it is done in global.asa file . But i don;t know how to do it? Please Explain me the working of global.asa file.
Also If I am creating a cookie and other site is also creating a cookie of same name then does this will create a problem?.
which is safe and better .. creating cookies or creating session variables.
I narrowed down with the shopping cart system on my site to the fact that session cookies are not enabled (or being allowed) in IE on some browsers...
I guess the default setting is "Automatic Cookie Handling"
it says that it uses P3P(W3C standard) to determine what cookies should be allowed and what should not...
what is the criteria to allow or block the acceptance of the cookie? I guess I will have to modify the site accordingly? Also what about older browsers...
I need to be able to user session variables on the site..
obviously if users disables cookies all together it will not work.. but it should allow for session cookies to be used.. no?
I recently discovered that my session cookies on the web host disappear within 30 seconds. I created some very simple asp scripts (it took me a while until I discovered why my shopping cart acts very weird...) to check the session cookies.
The same asp pages run on my XP Pro show that the session cookies don't expire as long as I close the browser, while on the remote web server, if I do a refresh on readcookie.asp after 30 seconds, they are gone.
I run ASP on the server and all I know is that it is a Plesk server. No idea if it actually a Linux server or a Windows one...
Do I have to setup expiry time or something for session cookies?
we are having a form where i can add products to my cart. so the user here can go on to no of pages giving details like no of products . i am using cookies for mantaining the session information like no of productds, product name, item price etc. now after all these process a page will apear where there wil be a button called "Pay Now". When the user clicks this button i should be able to clear all the cookies that are stored in the client side....
I'm involved in quite a large project which has a slightly unusual form of login (at least I think it's unusual!). I'm creating a site in ASP (actually Chilisoft ASP) where access to all pages has to be secured via login. The odd bit is that while the login page will be on this site, the login process itself will be carried out on a completely separate domain - this is the client's requirement so I have no choice.
On login, the user will be assigned a 24 hour cookie by this 2nd domain and then be passed back to the site I'm involved with. My site then needs to assign a similar cookie (I'm assming that I won't be able to read the other domain's cookie) and allow access to the site for 24 hours.
I'm wondering if it's most efficient to assign a session variable to indicate the user is logged in once my cookie has been generated (rather than have every page check for a cookie again) and on subsequent sessions during the 24 hour period to 1st check for session var, then the cookie and then, if cookie exists, to assign the session variable again.
We've just started getting a weird (and serious) problem with our ecommerce website.
Customers are logging in, which sets a session variable to their username (retrieved from the db). Then for no apparent reason at all, they'll be asked to login again a couple of minutes later.
e.g. Customer logs in, gets told they've logged in successfully, and they can access pages that require them to be logged in. Then, for example, they go to their 'My Account' page and are able to view it with no problems...simply refreshing the page a few times suddenly brings them back to the login page. Then a few more clicks on the 'My Account' button (without logging in a second time) and they're able to view it again.
It's really strange, it's as though the server loses track of the session for a moment, and then finds it again.
We're also getting problems with the shopping cart cookie that can display different quantities in the 'View Cart' page at different times without the customer actually changing the cart contents. Even after the customer completes an order and the cart contents are destroyed, the 'View Cart' page can continue to display the items they just purchased when it should be saying 'Your cart is empty'.
Given that we're having problems with both the cart cookie AND the login session variable (which also uses a cookie), and I'm almost 100% certain I've not touched any code that could interfere with either of these, I'm guessing that this is probably a problem with our ISP's web server but I'm not really sure. I really just want to see what you all think - if you think it's server related then I'll stop tearing my hair out going through all my code to see if it's our problem.
The login state in my site relies on a combination of session variables and encrypted cookies. Some of my users are reporting that they are being "logged out" by the system - which seems to be related to their cookies being blanked out. I've checked all of the code and now that it's not being overwritten by my ASP.
The weird thing is that my site has two domain names, both pointing to the same pages and directories (no redirect). If this problem is happening to them and they switch to the other domain name and log back into the site, they stay logged in no problem. It also seems to not recur if the person is "logged out" and then logs back into the site on their own.
I had one problem like this in the past, because I had a tracking cookie that was being written on every page, and found that some browsers (don't remember which) had a limit of how many cookies could be written - and when they hit the limit the oldest cookie was tossed out. However, I don't have any code doing this now.
Anybody have any ideas what could be going on? Are there any session variable/cookie limits on the server side?
I am encountering errors with some legacy asp scripts. The erorr returned when accessing these pages is:
Error Type:
(0x80004005) Unspecified error
and occurrs when cookies are disabled on the client's browser. Note, if cookies are enabled but no cookie exists, the script does not die, it is only when cookies are completely disabled. Code:
I want to have links to a CF app - specifically VeriSign's eCommerce Manager (on VeriSign's server).
The links in my app will need current values for CFID and CFTOKEN in their HREFs - I think these are cookies or session objects the VeriSign/CF app sets once logged in, they appear on the url.
Assume user has logged into VeriSign manager before my app.
ASP Session/Cookies, Help to Protect Page from Non users I am a beginner and very urgently need some help
I have created a asp page, that takes in a username and password and validates it as follows and then if true continues to the pages requested.
Code:
'Read in the password for the user from the database If (((Request.Form("txtUser")) = rsCheckUser("User_pass")) and (rsCheckUser("User_lev") = 1) ) Then 'If rsCheckUser("User_level") = 1 Then 'THE ABOVE CHECKS THE INFO IS CORRECT AND IT REDIRECTS TO THE PAGE BELOW and Session=True
'If the password is correct then set the session variable to True Session("blnIsUserGood") = "True"
'Redirect to the authorised user page and send the users name Response.Redirect"user_self_update_form.asp?ID=" & rsCheckUser("ID") & ""
'Close Objects before redirecting Set adoCon = Nothing Set strCon = Nothing Set rsCheckUser = Nothing
End If
Now this code takes you to page :Response.Redirect"user_self_update_form.asp?ID=" & rsCheckUser("ID") & "" Which is something like /project/user_self_update_form.asp?ID=1
Since after the login you do to this, you are allowed to see this page.
But The page user_self_update_form.asp?ID= can also be access if you just put the link on the browser. Lets say i log in as ID 2, and just change the ID to 3 on the address bar in the browser, i will log into someone elses page.
How to i block this from random access and only the SPECIFIC USER?
Code for user_self_update_form.asp (the protected page unless you are logged it): The Session = False part just does not work here, so if you get this link of someone, you can just get it, and you are not redirected.
<% 'If the session variable is False or does not exsist then redirect the user to the unauthorised user page If Session("blnIsUserGood") = False or IsNull(Session("blnIsUserGood")) = True then 'Redirect to unathorised user page Response.Redirect"unauthorised_user_page.htm" End If %>
<% 'Dimension variables Dim adoCon 'Holds the Database Connection Object Dim rsGuestbook 'Holds the recordset for the record to be updated Dim strSQL 'Holds the SQL query for the database Dim lngRecordNo 'Holds the record number to be updated 'Read in the record number to be updated lngRecordNo = CLng(Request.QueryString("ID"))
I am new to asp. I am trying to setup a log-in screen and am having trouble figuring out how to set the session cookie. I found the bit of code below, and it works if I enter a specific 'email' and 'password' into the "if" statement, however we have multiple users logging into the section. How can I set it up so that if the form is successfully submitted using any of the multiple email/password combos then it creates the session?
Example found...
<% Username=Request.Form("email") Password=Request.Form("Password") If email="emailaddress" AND Password="password" Then Session("Loggedin")=True End If %>
I need help with setting up a page where the viewer has to accept terms before they can access the rest of the website.
The page will have a bit of text explaining why they need to accept oor decline the terms and then have 2 buttons. ie. accept or decline.
What I need to be able to do is set this up so that if the viewer tries to bypass the accept/ decline page they will get re-directed to it. If they have clicked the accept button then they can view anywhere on the site.
I understand that 'sessions' in IIS don't actually close until about 20 mins after the user has left the site and can live with that. But if they come back the next day they must go through the accept/decline page to get into the site. It doesn't have to have usernames or password, they just have to accept.
I understand that you set up several pages to do this, i.e. the accept/decline page, a 'checkterms' page (which sets the session cookie?) and then some code on every other page on the site to check for the presence of the session cookie and let you view if it is there. If not, redirects you to the Accept/Decline page.
The problem I have is I don't know what code to write and where to put it into the page.
I have these 3 tabs that I want the user to be able to select, a variable to be set, and then each page they visit in the site to read that variable and subsequently display content based on the variable that is set. So, Sheridan tab sees "Sheridan" variable content, Gillette sees "Gillette" variable content, etc.....
i keep getting locked up, ctrl/alt/delete and a window opens up and say's web back agent not responding. is there a way to overcome this problem. it happens no matter what program i'm working with.
