security

Can one cause Page.IsPostBack to be true independently of ASP.net?

by

If one is checking a user’s roles to determine whether they may access a page, is it safe to put this check only inside an if (!Page.IsPostBack) { ... }? Could it be possible for the client to cause Page.IsPostBack == true independently of ASP.net; that is, the client POST’s to the page and sets the right form fields? If that were possible, then I suppose best practice would be to check security on every page load, not just when Page.IsPostBack == false.

How do you manage asp.net SQL membership roles/users in production?

by

How do you setup an asp.net sql membership role/membership provider on a production machine? I’m trying to setup BlogEngine.NET and all the documentation says to use the ASP.NET Website Administration tool from Visual Studio but that isn’t available on a production machine. Am I the first BlogEngine user to use it on a non-development box?