title: Log-In Page Mystery ASP.Net C#
body: <p>I've got a bit of a mystery on my hands and I'm hoping you all can help me figure it out. </p>
  
  <p>I'm creating a log-in page for an Asp.net C# web app. The log-in page is just a simple web form page with two textboxes for inputting username and password (with naming labels), a log-in button, and a hidden message label that is displayed via the back code, if I need it.</p>
  
  <p>The event handler for the log-in button is two parts. </p>
  
  <p>First it queries the database and pulls the fields userName, password, and userAccessLvl, from the table in my DB, where userName and password match the text inputs from the textboxes. Pretty straightforward. </p>
  
  <p>Up to this point, the code works just as it is intended to do.</p>
  
  <p>Now comes the second part. </p>
  
  <p>When the DB is queried and the matching record is found, I have that record populated into a dataset and I set a string variable called AccessLevel to equal the value of the userAccessLvl field from the DB table. I then run a switch statement to evaluate the value. </p>
  
  <p>If the value = "A" (for admin) then the log-in page should redirect the user to the admin page.</p>
  
  <p>If the value = "S" (for standard user) then the log-in page should redirect the user to the customer account page. </p>
  
  <p>In addition, both options will set Session variables called UserName and AccessLevel.</p>
  
  <p>Now here is the mystery. If I attempt to log in with any of the standard user accounts in the DB, then everything works out just fine. However if I attempt to log in as the admin account, then the log-in page simply refreshes and it doesn't redirect me anywhere.</p>
  
  <p>Code for the event handler follows.</p>
  
  <p>Any thoughts? I'm running VS 2015 Community and Access 2010 DB if it matters.</p>
  
  <p>Thanks.</p>
  
  <pre><code>public partial class logIn : System.Web.UI.Page
  {
  private OleDbConnection connection = new OleDbConnection();
  private dsUserLogIn LogInData;
  private OleDbDataAdapter sqlDA;
  private string AccessLevel;
  
  protected void Page_Load(object sender, EventArgs e)
  {
      connection.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0; Data Source=E:\\Documents\\Visual Studio 2015\\WebSites\\OneStopFurniture\\App_Data\\OneStopFur.accdb";
  
  }
  
  protected void btn_LogIn_Click(object sender, EventArgs e)
  {
  
      sqlDA = new OleDbDataAdapter("SELECT userName, [password], userAccessLvl FROM [userInfo] WHERE userName ='" + txtUserName.Text + "' AND [password] ='" + txtPassword.Text + "'", connection);
      LogInData = new dsUserLogIn();
      sqlDA.Fill(LogInData.userInfo);
  
      if(LogInData.userInfo.Count == 1)
      {
          lblLogInMessage.Visible = true;
          lblLogInMessage.Text = "Username and Password are correct.";
      }
      else
      {
          lblLogInMessage.Visible = true;
          lblLogInMessage.Text = "Username and Password are not correct.";
      }
  
      AccessLevel = LogInData.userInfo[0].userAccessLvl.ToString();
  
      switch (AccessLevel)
      {
          case "A":
  
              Session["UserName"] = txtUserName.Text;
              Session["AccessLevel"] = "A";
              Response.Redirect("adminArea.aspx");
              break;
  
          case "S":
              Session["UserName"] = txtUserName.Text;
              Session["AccessLevel"] = "S";
              Response.Redirect("customerAcctArea.aspx");
              break;
  
          default:
              break;
      }
  }
  </code></pre>
  
  <p>}</p>
  
  <p>EDIT----------------------------------------------------</p>
  
  <p>Ok. 
  I've set a break in the code to check the value of AccessLevel when the admin record is found. AccessLevel is set to "A"; just like it supposed to. </p>
  
  <p>I also set a break after Session["AccessLevel"] = "A" and checked that value. Again the value is set to "A"; just as intended. </p>
  
  <p>Finally, I checked my web.config file and couldn't find anything restricting access to any pages. </p>
  
  <p>This got me to wondering if the problem might not lay in the Page_Load function of the different account pages, instead of the log-in page. The Page_Load function for both the customer account and the admin pages contain an identical code block</p>
  
  <pre><code>protected void Page_Load(object sender, EventArgs e)
  {
      if(Session["AccessLevel"] == null)
      {
          Response.Redirect("login.aspx");
      }
      else
      {
          lblWelcome.Text = "WELCOME BACK " + Session["UserName"];
      }
  } 
  </code></pre>
  
  <p>Now again, for the standard user ("S") accounts, everything works fine. It's the admin ("A") accounts that are not working. </p>
  
  <p>A little Google research suggests that ASP.net doesn't like identical code like this on multiple pages and that it can cause unintended functions. </p>
  
  <p>Now the session object appears to be persisting between the pages of the site like it is supposed to, as I've checked other working pages and all attempts to read the current session object match the record of the account that is currently logged in.</p>
  
  <p>Do you think, that since the code blocks on the two pages are identical, that it's possible for the Page_Load code on the admin page to read the session object as null (even though it isn't) and then redirect me back to log-in?? 
  Would creating a separate class file for the code block be a possible work around? 
  Or would I simply be taking a long way around to get back to the same problem?</p>
  
  <p>Just throwing some ideas out there, trying to wrap my head around this one.
  Thanks for any help provided.</p>