Using Global.asax to set / check session variable and redirect (for user testing)

Question

I would like to add a very simple temporary protection to my site.

I made a page in Home / UnderConstruction where people checking the site can enter a password with a hard code, which then sets the "underconstruction" session variable to "false".

This is what I have so far, but it leads to too many redirects:

protected void Session_Start(Object sender, EventArgs e) { HttpContext.Current.Session["underconstruction"] = "true"; } protected void Application_AcquireRequestState(Object sender, EventArgs e) { if (HttpContext.Current != null && HttpContext.Current.Session != null) { var underconstruction = HttpContext.Current.Session["underconstruction"]; if (underconstruction != null) { string oc = underconstruction.ToString(); if (oc != "false") Response.Redirect("~/Home/UnderConstruction"); } } } 

Is that close to what I will need to do?

Here is the code we got to work:

Controller Code for UnderConstruction View

  public ViewResult UnderConstruction() { return View(); } [HttpPost] public ActionResult UnderConstruction(string ocp) { if (ocp == "mypassword") { Session["underconstruction"] = "false"; return RedirectToAction("Index", "Home"); } else { Session["beingredirected"] = "false"; return View(); } } 

global.asax

  protected void Session_Start(Object sender, EventArgs e) { HttpContext.Current.Session["underconstruction"] = "true"; HttpContext.Current.Session["beingredirected"] = "false"; } protected void Application_AcquireRequestState(Object sender, EventArgs e) { if (HttpContext.Current != null && HttpContext.Current.Session != null) { bool uc = false; var underconstruction = HttpContext.Current.Session["underconstruction"]; if (underconstruction != null) { uc = Boolean.Parse(underconstruction.ToString()); } bool redirected = false; var beingredirected = HttpContext.Current.Session["beingredirected"]; if (beingredirected != null) { redirected = Boolean.Parse(beingredirected.ToString()); } if (uc && !redirected) { if (Request.HttpMethod == "GET") { HttpContext.Current.Session["beingredirected"] = "true"; Response.Redirect("~/Home/UnderConstruction"); } else if (Request.HttpMethod == "POST") { } } HttpContext.Current.Session["beingredirected"] = "false"; } } 

Answer 1

Is ~/Home/UnderConstruction on another website? If not, is it not always redirected because oc will always be true? those. - Do you also need to add a check to the requested page so that you can bypass the redirect if you have already switched to the UnderConstruction page?

UPDATE

Not sure if checking the page name is a great idea, but something like this might work:

 protected void Session_Start(Object sender, EventArgs e) { HttpContext.Current.Session["underconstruction"] = "true"; HttpContext.Current.Session["beingredirected"] = "false"; } protected void Application_AcquireRequestState(Object sender, EventArgs e) { if (HttpContext.Current != null && HttpContext.Current.Session != null) { bool uc = false; var underconstruction = HttpContext.Current.Session["underconstruction"]; if (underconstruction != null) { uc = Boolean.Parse(underconstruction); } bool redirected = false; var beingredirected = HttpContext.Current.Session["beingredirected"]; if (beingredirected != null) { redirected = Boolean.Parse(beingredirected); } if (uc && !redirected) { HttpContext.Current.Session["beingredirected"] = "true"; Response.Redirect("~/Home/UnderConstruction"); } HttpContext.Current.Session["beingredirected"] = "false"; } } 

Note that I would clear this, this example was just to give a general idea.

UPDATE

If you want to use the roles mentioned in the comments, then