Log in log out

[ryan_les]

Hi Noobie low coder question without notice…
I have set security login and logout correctly so when the user logs out their security identity goes from a number to false so they are effectively logged out. But on testing they can still navigate back to pages and not be logged in or even append url with page name and be directed there even though logged out. Is this a localhost dev server thing and will it not happen in production or am i missing a step where they are effectively unauthorized to view pages until logged in,

,TIA

[sitestreet]

You need to click on ‘App’ in the App Structure panel, then click on ‘Security Provider Enforcer’ and this will then make the page redirect to your chosen page if the visitor isn’t logged in.

You also need to make sure you have used the Security Restrict action in all your API action scripts so that they can’t be run without logging in.

[ryan_les]

@sitestreet

‘Security Provider Enforcer’ a

Thank for the reply. I’ve added the restriction server side but enforcer seems to be missing

[sitestreet]

Have you set up the Security Provider in the Globals section of the API (Server Connect)?

This should be a good reference, too:

Full Login Procedure

What was meant to be a quick video as usual was not, but this should give you a good idea of the entire creation of a user login system, encompassing Login server action - login form - unauthorised error handling - success redirection Logout server action - logout redirection Add new user server action - add new user form Security Provider, Security Restrict, Password Hashing, Security Provider Enforcer, Retrieve logged in user details, Use logged in user details in a Server Connect query, A…

[Apple]

For some reason, the process is different for NodeJS

Applying Security to your NodeJS pages

[kfawcett]

Just in case someone stumbles upon this and is building a mobile app.

Using a redirection on the server side will not work on mobile apps. I add the User Server Connect to every mobile page with a Unauthorized Dynamic Event. If it returns unauthorized, then I use a Browser component’s go to action.