Page #39 (Chapter 5 - Securing an IIS Application)

	Chapter 5 - Securing an IIS Application
	Visual Basic Developers Guide to ASP and IIS
	A. Russell Jones

Copyright 1999 SYBEX Inc.

---

	Understand How Security Works

	In a stand-alone Windows program, you would simply show the sign-on page first—users would have to sign on before they could see any other screens in the application. In a Web site, any user can request any page for which they know the URL. They can (and often do) bookmark pages to which they want to return later. The Web application must intercept page requests from users who have not signed on and reroute them through the sign-on screen. Figure 5.1 shows a generic logic flow for handling sign-on/password security. You should note that the figure does not show any exception handling.

	The application requires only one HTML screen—the sign-on screen. All input and messages will occur on this screen. For illustration purposes, though, you'll add a second screen that will be "secured" behind the sign-on page. When the application is complete, you will not be able to get to the second screen unless you have successfully logged on.