Creating a Secure Base Page class for ASP.NET Pages

Every web application developed using .NET as application framework needs authentication as well as authorization. ASP.NET provides 2 types of authentication providers for the web applications, namely Windows Authentication Provider and Forms Authentication Provider. Am not going to discuss these types and various modes of authentication. But am going to write about how one can implement a code to secure their web pages. And specially if these pages require some kind of user login is a mandatory.

First, you create any page that is supposed to be secured, say for instance AccountDetails.aspx. This page by default takes the inheritance from System.Web.UI.Page class. Now that you have created the page, it is the time for you to induce the security for this page. So add a new class to your application and name that as SecureBasePage.CS. This class is now inherited from System.Web.UI.Page class. The code would look like below

public class SecureBasePage : System.Web.UI.Page
{
    public SecureBasePage()
    {
    }
}

So you have created a class that is similar to that of System.Web.UI.Page class. Now, all you have to do is implement the custom security for this page and inherit your AccountDetails.aspx from this SecureBasePage.. For the implementation of custom security, I take the help of Session Object. And I check that whether the current session has a variable called as LoggedInUser and that is associated with some value. So I have started testing for this value at the constructor of SecureBasePage.

if (Session[ApplicationConstants.SessionVariables.LoggedUserID] == null)
 {
    Response.Redirect("LoginPage.aspx");
 }

While working in this I’ve encountered a huge problem and the problem in terms of the SessionObject. When this session object is used in the SecuredBasePage class, I got the following exception

Exception Details: System.Web.HttpException: Session state can only be used when enableSessionState is set to true, either in a configuration file or in the Page directive. Please also make sure that System.Web.SessionStateModule or a custom session state module is included in the <configuration> \ <system.web> \ <httpModules> section in the application configuration.

I’ve tried all the possibilities like

1) Adding the enableSession at PageDirective

2) Adding session tag at http Modules as mentioned below

<httpModules>
    <add name="Session" type="System.Web.SessionState.SessionStateModule"/>
 </httpModules>

3) Adding page directive for the page section with the below code

<pages enableSessionState="true" enableViewState="true" enableViewStateMac="true" validateRequest="false" />

4) And many more when binged for this error

Finally, I realized that at the time of the constructor of this class, the session is not created. So we have to implement the session validation in any other events of the System.Web.UI.Page class. So I’ve written that in OnInit event

protected override void OnInit(EventArgs e)
 {
      base.OnInit(e);
     if (Session[ApplicationConstants.SessionVariables.LoggedUserID] == null)
     {
            Response.Redirect("LoginPage.aspx");
     }
 }

But here also there raised a problem because the session is still not instantiated with the passed variable. So all you have to do is just change session from generic to CurrentContext

protected override void OnInit(EventArgs e)
 {
      base.OnInit(e);
      if (HttpContext.Current.Session[ApplicationConstants.SessionVariables.LoggedUserID] == null)
      {
           Response.Redirect("LoginPage.aspx");
      }
 }

That is solved and your AccountDetails page is now ready for inheritance from this SecureBasePage.CS..

What do you say ?