what or how to do if the user need to change password before entering the system.

[spncc]

i'm making Form authenticate page to let the user first logon before
using the application. However, like most security manner, the new
user is needed to first logon and forced to change password before
using the application.

My problem is
- When the user passed the authentication at logon page, we need to
redirect them to change thier password. but anyway the user can type
at the address bar to surf other pages on the application. What should
i do to avoid that situation. if the user does not successfully change
the password, they are not allow to use the applicaiton (even view the
page as if they never logon successfully).

any idea is truely appreciate.

 

[Diego Jancic]

Why don´t you logon the user as a kind of Anonymous user, that way the
user will have no permissions to access important stuff. Once the user
change his password you overwrite the cookies and let the user logon
as the user himself..
Hope this helps,
Diego

 

[spncc]

Why don´t you logon the user as a kind of Anonymous user, that way the

-->> it's the application for my company only that will be access from
various country.
it's the application not just intranet pages. so we need the logon
page for authentication.

user will have no permissions to access important stuff. Once the user
change his password you overwrite the cookies and let the user logon

--> i'm not allow to use cookies :S

as the user himself..
Hope this helps,
Diego

and Diego, how can i logon with anonymous and know which one is loggin
in ???
and is it applied to window authenticate mode???
i don't want the user to surf to any pages before they logon.

and if the user is succesfully logon (authentication is true) then
user can goto other pages.

but if that is the first time logon, user need to change pasword.
at that time..... with authenticate = true, the user can go to any
pages ....
but if i force authenticate = false ......
then even the change password page is not available......

rite????

then how can they change the password then ???