c# - asp.net deny specific user cookie during login -

i'm trying deny specific user login in administrative area of system, after gets formsauthenticationticket expiration of 30 days now. i'm doing manually , i'm using asp.net webforms.

my login code follows:

protected void btnlogin_click(object sender, eventargs e) {     user u = logindataaccess.checklogin(txtemail.text, txtpassword.text);     if (u.id == 0)     {         lbinfo.text = "invalid credentials.";         lbinfo.cssclass = "label-warning";     }     else     {         logindataaccess.authenticate(u, response.cookies, cbrememberme.checked);     }             } 

and logindataaccess.authenticate method this:

public static void authenticate(user user, httpcookiecollection cookies, bool remember) {     genericidentity gi = new genericidentity(user.name);     string role = userroles.getrole(user.roles);     genericprincipal gp = new genericprincipal(gi, new string[] { role });     formsauthentication.redirectfromloginpage(user.name, true);      if (remember)     {         cookies.clear();         datetime expirydate = datetime.now.adddays(30);         formsauthenticationticket ticket = new formsauthenticationticket(2, user.nome, datetime.now, expirydate, true, string.empty);         string encryptedticket = formsauthentication.encrypt(ticket);         httpcookie authenticationcookie = new httpcookie(formsauthentication.formscookiename, encryptedticket);         authenticationcookie.expires = ticket.expiration;         cookies.add(authenticationcookie);     } } 

my check login method search database user. it's clear me need every time user starts session. how this?

if want inject custom authentication logic application, in global.asax create method called application_authenticaterequest. code there gets executed right after internal authentication mechanisms.

protected void application_authenticaterequest(object sender, eventargs e) {     var context = httpcontext.current;      if (context.user != null && context.user.identity != null && context.user.identity.isauthenticated)     {         if (someclass.userisexpired(context.user))         {             // clear cookies or whatever need             // throw 401 deny access             throw new httpexception(401, "user account expired");         }     } } 

see post detailed information on how authentication occurs:

authenticaterequest event