Hi all,I am migrating an ASP app. to an ASP.NET and have spotted a potential security hole. Most of the app. I am securing with Forms authentication but as stands they have another requirement where by users who are just contacts who exist in the system without a username or password can access certain parts of the site which are sensitive. They have been entered in the system by importing an excel or SAP feed. They have not been created via the system and as such do not have usernames or passwords. The way things stand at the minute, the user gets redirected to a page where they create a 4 digit pin number which allows them to access the system via another page. This seems terrible to me. Can anyone think of a better way of handling this situation? Cheers [EMAIL PROTECTED] _________________________________________________________________ Telly addicts unite! http://www.searchgamesbox.com/tvtown.shtml =================================== This list is hosted by DevelopMentor® http://www.develop.com
View archives and manage your subscription(s) at http://discuss.develop.com
