I have been tasked with implementing a secure account login system for a website's content management system. I have built a solution around an access masterpage that handles all account access functions. Here is the Page_LoadProtected Sub Page_Load() Handles Me.Load    If Not Request.IsSecureConnection Then        Response.Redirect(Request.Url.ToString.Replace(http://, https://))    End If    UpdateSecurity()End SubAnd the definition of UpdateSecurity()Private Sub UpdateSecurity()    PageContentPanel.Visible = Session(access)    PleaseLogInPanel.Visible = Not Session(access)End SubAs you can probably infer from the snippet, having access set in the Session makes an asp:Panel containing the content of whatever child page the user requested visible, otherwise, the PageContentPanel is hidden, and the PleaseLogInPanel with a username and password prompt is made visible. In the handler for the login button (also on the login Panel), the posted credentials are verified and if correct, Session values are added. I was wondering if this implementation is fundamentally sound or not. Page requests from not logged in users still execute (I think), but the results are hidden inside an invisible asp:Panel. I'm not familiar enough with the ASP.NET security model to know if this poses risks or not from wayward POSTs. If a child page utilizes this masterpage, what access do not logged in users have to resources on the page?
ASP.NET account login system implemented via Masterpage and Panels
asp.net;security;vb.net