ASP.NET authentication design
<p>could you please validate if my authentication solution is elegant and safe enough. </p>

<p>Web.config</p>

<p><code>&lt;authentication mode="Forms"&gt;
          &lt;forms name=".ASPXFORMSDEMO" loginUrl="logon.aspx"
          protection="All" path="/" timeout="30" /&gt;
        &lt;/authentication&gt;
</code></p>

<p><code>
        &lt;authorization&gt;
          &lt;deny users ="?" /&gt;
          &lt;allow users = "*" /&gt;
        &lt;/authorization&gt;
</code></p>

<p>In Logon.aspx.cs I have two methods:</p>

<pre><code>private bool ValidateUser(string userName, string passWord)
private void LoginButton_Click(Object sender, EventArgs e)
</code></pre>

<p>Inside <code>ValidateUser</code> method all I am doing is executing SQL query to check if entered credentials is similar to database records.
If credentials match I want to perform redirection to page called <code>PrivateRoom.aspx</code> say using <code>Response.Redirect("PrivateRoom.aspx", true);</code> </p>

<p>What do you guys think about such design? How elegant it is and how secure?
Actually, also how do I protect <code>PrivateRoom.aspx</code> against unauthorized access?? Say I always can go <code>http://mysite.com/PrivateRoom.aspx</code> and it will open this page.</p>

<p>Thank you for your answers!!! </p>
