> For the complete documentation index, see [llms.txt](https://reyvaleza.gitbook.io/vibe.d-tutorial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://reyvaleza.gitbook.io/vibe.d-tutorial/enforcing-authorization-through-the-session.md).

# Enforcing authorization through the session

We want to restrict access to all the pages in the app except the home page and the login page, but right now, clicking any of the links on the menu shows the page. Meaning, all the links in the menu are available and viewable by anyone. No restrictions at all. We need to rectify that.

Only the home page and the login page should be accessible to anyone and the rest should be accessible only to logged-in users. We should add a way to check if the user is logged in before deciding to open a page.

Edit **source\empcontrol.d** and add this code at the end.

```d
private enum auth = before!ensureAuth("_authUser");
private string ensureAuth(HTTPServerRequest req, HTTPServerResponse res)
{
  if(!m_user.loggedIn) redirect("index");
  return m_user.email;
}
mixin PrivateAccessProxy;
```

The **@auth** annotation is a shortcut for calling the **ensureAuth()** method to check if the user is logged in before running a method.

That **mixin** statement there is needed to make this private function accessible.

This function redirects to the **index()** method if the user is not logged in yet.

Then we defined a shortcut to the **ensureAuth()** function with this:

`private enum auth = before!ensureAuth("_authUser");`

so we can just use **auth** to mean we are calling the **ensureAuth()** private function, like this:

```jade
@auth 
void getAddEmployee(string _error = null)
```

The **@auth** annotation calls the **ensureAuth()** method, which checks the logged-in state, before running the **getAddEmployee()** method.

Since the **ensureAuth()** function is receiving an **\_authUser** variable, we now have to add it as an argument to all the methods that call **ensureAuth()**, like this:

```d
@auth 
void getAddEmployee(string _authUser, string _error = null)
```

We should add the **@auth** annotation to each method that requires authorization.

We did not make any changes to the **source\empmodel.d**, so we are good.

Compile, run and refresh the browser. Click any link on the menu except the Login link and you should be redirected to the home (index) page.

However, once you logged in, you will be able to visit all the pages.

Now we are assured that sensitive data is protected and accessible only to authorized users.

How let's talk about logging out,.