Page restriction setup help

Question

Hi I have an admin section I of course want to restrict site visitors from gaining access to. I have a login form, a login error template, application template, and a logout template. I also have a restrictAccess.cfm template that has a cfif condition. I can login in and everything redirects the way it is suposed too. I can logout as well. I can type the wrong username and password and get redirected to the loginError page, but I can still type in the URL to my adminHome page and it doesnt restrict my access. I have a cfinclude for the restrictAccess.cfm at the beginning of the adminHome page, but that doesnt seem to do anything.
here is my restrictAccess.cfm code.
          <cfif SESSION.login EQ "No">
          <cflocation url="loginForm.cfm" addtoken="no">
          </cfif>
This is the cfinclude on my adminHome.cfm
          <cfinclude template="restrictAccess.cfm">
and here is the application.cfm
          <!--- Code gets executed with every page request!! --->
         <cfapplication name="login" sessionmanagement="Yes">
         <cfparam name="SESSION.login" default="No" type="any">
I tried using the restrict access tool in DW, but didnt have much luck. Can someone please give me some pointers as to why this isnt working properly. Thanks so much!

Answer 1

Hi Bob, thanks for the info! I did go over those tutorials and pretty much have the same code as suggested when using a database to handle login info here is my loginAction code:
<cfparam name="FORM.username" default="1" type="any">
<cfparam name="FORM.password" default="None" type="any">
<!--- Check user --->
<cfquery name="rsLogin" datasource="rlbulbs">
SELECT userName, passWord
FROM rlbadmin
WHERE userName = '#FORM.username#'
AND passWord = '#FORM.password#'
</cfquery>
<cfif rsLogin.Recordcount GT 0>
  <cfset SESSION.login = "Yes">
  <cflocation url="adminHome.cfm" addtoken="no">
  <cfelse>
  <cflocation url="loginError.cfm" addtoken="no">
</cfif>
Again. the restrictAccess.cfm is the page that should load before my adminHome page using the cfinclude. The restrictAccess page sets the SESSION.login to "NO"
<cfif SESSION.login EQ "No">
<cflocation url="loginForm.cfm" addtoken="no">
</cfif>