Quote Originally Posted by johntheface View Post
sorry, i should have said from the outset that this is a web-application rather than a website. if they disable javascript the application won't work at all
it's still not that secure. You can easily edit the client-side code(view source from any browser), save as an .aspx file, then open it without the javascript checking for the cookie.

Why don't you do the checking of the cookie on the server side using the Page_Load event?

I have a similar situation where I have a number(6-7) of web applications that are secured. I use the web.config file and the FormsAuthentication class to do all the re-routing if the user isn't authenticated.