We have an asp.net web application where we do not have any kind of role memberships implemented but the application handles 5-6 different roles based on the code wriiten in c#.
So among these roles, who can see which page is based of the code-behind that I wrote in the master page where I makes certain pages visible and not visible to certain roles. And we do not even have a site map to do the security trimming based on the roles, coz we do not use role membership at all.
The Issue: page1.aspx should not be seen by users in role2, and it works fine. But when a user in role2 copies the url of page1.aspx and tries to access it, then the page1.aspx appears to him.
Is there a way that I can overcome this issue ?
...
Go to the complete details ...