This topic is locked

Security Question

10/17/2007 9:36:36 AM
ASPRunnerPro General questions
L
lonestar author

I'm having some security issues with my projects.
Currently I'm developing a site with 2 separate ASPRunner Projects. They are completely separate using different databases and login credentials. However, when an admin logs into Project A they can make changes to Project B. I assume this has to do with the cookie for the login but am not sure how to make it more secure. If someone could help it'd be appreciated.
Also, how do I stop people from viewing the Menu page if they aren't logged in?
Last but not least, how do I force a logout when the browser is closed so that if someone forgets to log out the next user can't use their account?
Thanks in advance.

Sergey Kornilov admin 10/17/2007

Make sure you create a separate virtual directory for each project.
In this case Session variables won't be shared between projects.

L
lonestar author 10/18/2007

Do you know if this is possible with a Windows hosting account through GoDaddy.com?

Sergey Kornilov admin 10/18/2007

You need to contact GoDaddy support in this regard.
You can also check our hosting service at http://www.inspirunner.com.

L
lonestar author 10/18/2007

I've contacted GoDaddy and am waiting on a reply.
In the meantime, are there any other solutions to this problem?

Sergey Kornilov admin 10/18/2007

There is no other solution - this is the way how ASP sessions work.

L
lonestar author 10/18/2007

If that is the case then there is no way to keep 2 projects separate from each other on a GoDaddy hosting account. GoDaddy informed me that there is no way to create separate virtual drives on their hosting accounts.
Just a heads up to all the GoDaddy users out there.
Did you have an answer for my other 2 questions?
"Also, how do I stop people from viewing the Menu page if they aren't logged in?
Last but not least, how do I force a logout when the browser is closed so that if someone forgets to log out the next user can't use their account?"

L
lonestar author 10/18/2007

Also.... Would changing SESSION("UserID") in one project to SESSION("UserID1") and leaving the other the same solve my problem?

L
lonestar author 10/19/2007

OK I've found a solution. If you change the usertype in the DB for one project from "admin" to "admin1" and make the corresponding changes in the login page and commonfunctions page this takes care of the cross admin privileges between projects.