title: ASP.Net C# How to make a page on website accessible after authenticating via logon
body: <p>I've been playing with some of the MVC tutorials on making a database website with C# and have a question about how to make a section of the website only accessible ONCE a user has logged in with a username and password. </p>
  
  <p>I have a logon page (code below), which takes the username and password, and then authenticates a user against a database record. Once you've clicked the "login" button the return URL takes you into an Admin section of the website (full path is: <a href="http://localhost:53559/Data/update" rel="nofollow">http://localhost:53559/Data/update</a>). This bit I'm happy with. However, the issue I have is that the "update" page is still accessible if you've NOT logged in I.e. if I enter in the browser the path above (http://localhost:53559/Data/update) without ever logging in first it will load no problem).</p>
  
  <p>How do I restrict the update page, so it is only available once the user has logged in?</p>
  
  <p>(NB: total beginner, small words please!)</p>
  
  <p>==================================================================================</p>
  
  <h1>Controller code for the logon:</h1>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Web;
  using System.Web.Mvc;
  using System.Web.Routing;
  using System.Web.Security;
  using DFAccountancy.Models;
  
  namespace DFAccountancy.Controllers
  {
  public class AdminController : Controller
  {
  
      //
      // GET: /Admin/LogOn
  
      public ActionResult LogOn()
      {
          return View();
      }
  
      //
      // POST: /Account/LogOn
  
      [HttpPost]
      public ActionResult LogOn(LogOnModel model, string returnUrl)
      {
          if (ModelState.IsValid)
          {
              if (Membership.ValidateUser(model.UserName, model.Password))
              {
                  FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
                  if (Url.IsLocalUrl(returnUrl) &amp;&amp; returnUrl.Length &gt; 1 &amp;&amp; returnUrl.StartsWith("/")
                      &amp;&amp; !returnUrl.StartsWith("//") &amp;&amp; !returnUrl.StartsWith("/\\"))
                  {
                      return Redirect(returnUrl);
                  }
                  else
                  {
                      return RedirectToAction("Update", "Data");
                  }
              }
              else
              {
                  ModelState.AddModelError("", "The user name or password provided is incorrect.");
              }
          }
  
          // If we got this far, something failed, redisplay form
          return View(model);
      }
  
      //
      // GET: /Account/LogOff
  
      public ActionResult LogOff()
      {
          FormsAuthentication.SignOut();
  
          return RedirectToAction("Index", "Home");
      }
  </code></pre>
  
  <p>==================================================================================</p>
  
  <h1>This is the View code for the Update page (which is the Admin section, and should only be accessible once the user has logged in):</h1>
  
  <pre><code>@model DFAccountancy.Models.Data
  
  @{
      ViewBag.Title = "Update";
  }
  
  
  
  &lt;h2&gt;Update&lt;/h2&gt;
  
  &lt;script src="@Url.Content("~/Scripts/jquery.validate.min.js")" type="text/javascript"&gt;        &lt;/script&gt;
  &lt;script src="@Url.Content("~/Scripts/jquery.validate.unobtrusive.min.js")"         type="text/javascript"&gt;&lt;/script&gt;
  
  &lt;script type="text/javascript"&gt;
  $(function () { $("#cl_button1").click(function () { $("#para1").val(""); }); });
  $(function () { $("#cl_button2").click(function () { $("#para2").val(""); }); });
  &lt;/script&gt;
  
  @using (Html.BeginForm()) {
  @Html.ValidationSummary(true)
  &lt;fieldset&gt;
      &lt;legend&gt;Data&lt;/legend&gt;
  
      &lt;div class="editor-label"&gt;
          @Html.LabelFor(model =&gt; model.para1)
      &lt;/div&gt;
      &lt;div class="editor-field"&gt;
          @Html.TextAreaFor(model =&gt; model.para1, new { cols = 75, @rows = 5 })
          @Html.ValidationMessageFor(model =&gt; model.para1)
      &lt;input id="cl_button1" type="button" value="Clear Paragraph" /&gt;
      &lt;/div&gt;
  
      &lt;div class="editor-label"&gt;
          @Html.LabelFor(model =&gt; model.para2)
      &lt;/div&gt;
      &lt;div class="editor-field"&gt;
          @Html.TextAreaFor(model =&gt; model.para2, new { cols = 75, @rows = 5 })
          @Html.ValidationMessageFor(model =&gt; model.para2)
          &lt;input id="cl_button2" type="button" value="Clear Paragraph" /&gt;
      &lt;/div&gt;
  
      &lt;p&gt;
          &lt;input type="submit" value="Update" /&gt;
          &lt;input type="reset" value="Re-Set to begining" /&gt;
      &lt;/p&gt;
  
  &lt;/fieldset&gt;
  }
  
  &lt;div&gt;
  @Html.ActionLink("Back to List", "Index")
  &lt;/div&gt;
  </code></pre>
  
  <p>==================================================================================</p>
  
  <h1>This is the Controller code (DataController) that sits behind the Update View page:</h1>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Data;
  using System.Data.Entity;
  using System.Linq;
  using System.Web;
  using System.Web.Mvc;
  using DFAccountancy.Models;
  
  namespace DFAccountancy.Controllers
  { 
      public class DataController : Controller
      {
      private DataDBContext db = new DataDBContext();
  
      //
      // GET: /Data/
  
      public ViewResult Index()
      {
          return View(db.Data.ToList());
      }
  
      //
      // GET: /Data/Details/5
  
      public ViewResult Details(string id)
      {
          Data data = db.Data.Find(id);
          return View(data);
      }
  
  
  
      //
      // GET: /Data/Update
  
      public ActionResult Update()
      {
          var model = db.Data.FirstOrDefault();
          return View(model);
      }
  
      //
      // POST: /Data/Update
  
      [HttpPost]
      //[Authorize(Roles = "Administrator")]  //Created Validataion so inaccessible from outside
      [ValidateInput(false)]
      public ActionResult Update(Data data)
      {
          if (ModelState.IsValid)
          {
              data.ID = 1; //EF need to know which row to update in the database.       
              db.Entry(data).State = EntityState.Modified;
              db.SaveChanges();
              return RedirectToAction("Index", "Home");
          }
          return View(data);
      }
  
  
  }
  }
  </code></pre>