Problem with using Login.inc and Frames Pages

[Robert Lambrecht]

1. I have the following code as part of my Login.inc file.

' Do not cache this page.
Response.CacheControl = "no-cache"

' Define the name of the users table.
Const USERS_TABLE = "members"
' Define the path to the logon page.
Const LOGON_PAGE = "/subweb/logon.asp"
' Define the path to the logon database.
Const MDB_URL = "/subweb/fpdb/mydatabase.mdb"

' Check to see whether you have a current user name.
If Len(Session("UID")) = 0 Then
' Are you currently on the logon page?
If LCase(LOGON_PAGE) <> LCase(Request.ServerVariables("URL")) Then
' If not, set a session variable for the page that made the request...
Session("REFERRER") = Request.ServerVariables("URL")
' ...and redirect to the logon page.
Response.Redirect LOGON_PAGE
End If
End If

2. All of my webpages have the following script at the very top.
<%@ Language=VBScript %>
<!--#include virtual="/members/_private/logon.inc"-->
If the page is accessed and they aren't logged in, they are automatically
routed to the /subweb/logon.asp page to login. This works very well.

3. My Logon.asp page contains the following script:

<%
' Was this page posted to?
If UCase(Request.ServerVariables("HTTP_METHOD")) = "POST" Then
' If so, check the username/password that was entered.
If ComparePassword(Request("MBR"),Request("UID"),Request("PWD")) Then
' If comparison was good, store the user name...
Session("MBR") = Request("MBR")
Session("UID") = Request("UID")
Session("PWD") = Request("PWD")
Session.Timeout = 1
' ...and direct to member default page.
Response.Clear
Response.Redirect "default.asp"
Response.End
Else
' ...and direct to failed login page.
Response.Clear
Response.Redirect "failedlogin.asp"
Response.End
End If
End If
%>

4. I cannot figure out how to handle a login Session.timeout when using
frames pages. I have split frames and when a Session.timeout occurs it of
course requires the user to log back in to continue. Using frames however,
it launches the login.asp into any frame that is attempted to access. If the
Browser refresh button is clicked it reloads the controlling frames page,
which then in turn resets to the TOP, which access the logon.inc file and
then displays a normal login.asp page.

Is there any code I can use or something I can do to get around being
trapped with a login.asp page being displayed in the frames pages?

The Logon.inc file uses a Response.Redirect which won't allow target the
target="_top" and the Const LOGON_PAGE simply provides path information to
locate the actual logon.asp page.

5. I have the follow script in all the frames pages, but it appears it
doesn't really do anything. I was hoping that if a timeout was sensed on
attempting to use the page, it would send the focus back to the master
frames page, which would then cause the login.asp to come up. It may well be
doing this, but nothing is on top. No refresh of the master frames page is
occurring.

<%
If Len(Session("UID")) = 0 Then
Response.Clear
Response.Redirect "database_editor.asp"
Else
End If
%>

Any help with this would be deeply appreciated. I just can't seem to locate
anything anywhere regarding this issue.

 

[Kevin Spencer]

Framesets are notoriously difficult to use with Sessions, as, depending upon
the browser, Sessions may or may not be shared by different frames. I would
suggest that you do one of the following:

1. Get rid of frames.
2. Get rid of Sessions
3. Hire an experienced, professional programmer to work out how to use both.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.