Author: piotrekxxxxxx | Posted on: 11/14/2009 4:24:20 AM | Views : 377

Hi, I am using forms authentication in my app. I log in, do something in vendors gridview (custom) and press log out (below code is on logged out event). Then I go to address bar remove login.aspx and whatever is after and I type in /admin/vendors.aspx. I am in. Joke?! I did not change any settings in roles and access groups, but I believe by default not logged in user can only access login.aspx?
 Session.Abandon();
 FormsAuthentication.SignOut();
 Response.Redirect("login.aspx");

 
...

Go to the complete details ...