ASP.NET Forum

**blip** · 09:11 AM

Hi, I am trying to do a very basic and simple password verifier using cookies. Mozilla keeps telling me that it can't perform the redirect commands and suggests
that a possible reason is that cookies have been disabled, but they haven't been disabled, so it's something else, but it still probably has to do with cookies. Here's the code, can anybody tell me what I might be doing wrong?

Here are the pages. Login.asp takes a username and password and then submits to passwordcheck.asp

<html>
<head>
<title>Logon Form</title>
</head>
<body bgcolor="#FFFFFF">
<center>
<FORM ACTION="passwordcheck.asp" method="post">
<table height="100%">
<tr>
<td align="center">
<h3>Login to Bowserlaw admin</h3>
<p>
Username:
<INPUT TYPE="text" NAME="User" VALUE='' size="20"></INPUT>
<br>
Password:
<INPUT TYPE="password" NAME="password" VALUE='' size="20"></INPUT><br>
<INPUT TYPE="submit" VALUE="Logon"></INPUT>
</FORM>
</center>
</body>
</html>

Here is what passwordcheck does with the submission

<%
if Request.Form("User") <> "frib" OR Request.Form("password") <> "frab" then
Response.Redirect "login.asp"
Else
'Set the validation cookie and redirect the user to the default admin page.
Response.Cookies("Bowserlaw") = "OK"
Response.Redirect "dwiadmin.asp"

End if
%>

Then, with each content page, I #include password.asp at the top, which checks for a set cookie before it does anything else.

<%

if Request.Cookies("Bowserlaw") <> "OK" then
Response.Redirect "login.asp"
End if
%>

Pretty simple right? So why doesn't it work? Thanks in advance.

**chrishirst** · 12:23 PM

it's probably this logic

Code:

if Request.Form("User") <> "frib" OR Request.Form("password") <> "frab" then

it is much better to do a two stage check

Code:

if request.form("user") <> Valid_username then 
   'kick them out
else
   if request.form("password") <> Valid_Password then
     'kick them out here as well
    else
      'process the cookie/session
    end if
end if

some example code at Programming Articles - Code - ASP - Site Logon

**blip** · 08-21-2006, 12:28 PM

I don't understand why splitting the if statement up would change anything. The statement says if either one are incorrect, redirect them to the login page. I don't get it. Sorry if I am being dense.

**yoemanspiffy** · 05:34 PM

Other than allowing you to trap what the error was, there is no difference, and it has no effect on the setting of the cookie.

I copied this onto my server and got it to work on IE/Firefox/Mozilla, etc.

The code is clean amigo.

YM

**saadatshah** · 08-24-2006, 07:49 AM

Code looks fine to me