Authentication using Server Variable
===

There is an asp.net website in which authentication is as follows. The link to the website will be access from a portal. Using cleartrust, the server variables will be set. One of such server variable is “UserID”.   

In the homepage, following logic is used. It retrieves the server variable “UserID”. If it is returning a non-null value, it is considered as authenticated.

I need to prove that the above approach is not enough. That means, when somebody else make a request to the website url by setting the server variable, they can see data. I want to create another website which will call the current website by setting the server variable. Is it possible to do so?

 
        protected void Page_Load(object sender, EventArgs e)
        {
 
            string user = getCtHeader(this.Request, "UserID").Trim();
 
        }
 
        public static string getCtHeader(HttpRequest request, string key)
        {
            string value = request.ServerVariables[key];
            return value;
        }
    }
