.Net之美读书笔记14

Asp.net 的验证和授权

Asp.net为用户提供了一套验证机制，用户只需要遵守就可以。用户需要明白验证流程就可以了

1. 用户输入用户名和密码是否有效检验
2. 为有效用户创建cookie HttpCookie authCookie = FormsAuthentication.GetAuthCookie(userName, true)
3. 利用创建的cookie 得到票据ticket FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(authCookie.Value);
4. 将票据ticket转换为cookie并输出authCookie.Value = FormsAuthentication.Encrypt(newTicket);HttpContext.Current.Response.Cookies.Add(authCookie);

5. 如果按照前四步，则asp.net内部处理了登陆状态；可以调用Request.IsAuthenticated是否认证，获取用户信息FormsIdentity identity = User.Identity as FormsIdentity;string userName = User.Identity.Name;

   基本验证

6. 新建一空的webForm站点
7. web.config

<authentication mode="Forms">
    <forms timeout="600" slidingExpiration="true" loginUrl="~/SignIn.aspx" />
</authentication>

1. Login.aspx

<form id="form1" runat="server">
    <asp:LoginView ID="LoginView1" runat="server">
        <LoggedInTemplate>
            <asp:LoginName ID="LoginName1" runat="server" />
            ，你已经登录了^_^
            <br />
            <br />

            你可以选择
            <asp:LoginStatus ID="LoginStatus1" runat="server" LogoutPageUrl="~/Logout.aspx" LogoutAction="Redirect" />
        </LoggedInTemplate>
        <AnonymousTemplate>
            用户名：<asp:TextBox ID="txtUserName" runat="server" Width="128px"></asp:TextBox>
            <br />
            密　码：<asp:TextBox ID="txtPassword" runat="server"></asp:TextBox>
            <br />
            <asp:Button ID="btnLogin" runat="server" Text="登 录" OnClick="btnLogin_Click" Width="100px" />
            <br />
            <br />
            <asp:Label ID="lbMessage" runat="server" ForeColor="Red" Text=""></asp:Label>
        </AnonymousTemplate>
    </asp:LoginView>
</form>

code:

    public partial class Login : System.Web.UI.Page
    {
        private enum LoginResult
        {
            Success,
            UserNotExist,
            PasswordWrong
        }
        // 用户登录
        private LoginResult CheckUser(string userName, string password)
        {

            string validPassword = "123";   // 包含正确的密码
            string validUserName = "sa";
            // 判断用户名是否正确
            if (validUserName.Equals(userName))
            {
                // 判断密码是否正确
                if (password.Equals(validPassword))
                    return LoginResult.Success;
                else
                    return LoginResult.PasswordWrong;
            }
            // 用户名不存在
            return LoginResult.UserNotExist;
        }

        protected void btnLogin_Click(object sender, EventArgs e)
        {

            TextBox txtUserName = LoginView1.FindControl("txtUserName") as TextBox;
            TextBox txtPassword = LoginView1.FindControl("txtPassword") as TextBox;
            Label lbMessage = LoginView1.FindControl("lbMessage") as Label;

            string userName = txtUserName.Text;
            string password = txtPassword.Text;

            LoginResult result = CheckUser(userName, password);

            string userData = "登录时间" + DateTime.Now.ToString();

            if (result == LoginResult.Success)
            {
                SetUserDataAndRedirect(userName, userData);
            }
            else if (result == LoginResult.UserNotExist)
            {
                lbMessage.Text = "用户名不存在！";
            }
            else
            {
                lbMessage.Text = "密码有误！";
            }
        }

        // 添加自定义的值，然后导航到来到此页面之前的位置
        private void SetUserDataAndRedirect(string userName, string userData)
        {
            // 获得Cookie
            HttpCookie authCookie = FormsAuthentication.GetAuthCookie(userName, true);

            // 得到ticket凭据
            FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(authCookie.Value);

            // 根据之前的ticket凭据创建新ticket凭据，然后加入自定义信息
            FormsAuthenticationTicket newTicket = new FormsAuthenticationTicket(
                ticket.Version, ticket.Name, ticket.IssueDate,
                ticket.Expiration, ticket.IsPersistent, userData);

            // 将新的Ticke转变为Cookie值，然后添加到Cookies集合中
            authCookie.Value = FormsAuthentication.Encrypt(newTicket);
            HttpContext.Current.Response.Cookies.Add(authCookie);

            // 获得 来到登录页之前的页面，即url中return参数的值
            string url = FormsAuthentication.GetRedirectUrl(userName, true);

            Response.Redirect(url);
        }
    }

1. Default.aspx

    <form id="form1" runat="server">
        <asp:LoginView ID="LoginView1" runat="server">
            <AnonymousTemplate>
                欢迎访问, 游客 !      
            </AnonymousTemplate>
            <LoggedInTemplate>
                你好,
            <asp:LoginName ID="LoginName1" runat="server" />
                !
            <br />
                <strong>UserData值：</strong>
                <asp:Literal ID="lbUserData" runat="server" />
            </LoggedInTemplate>
        </asp:LoginView>
        <br />
        <asp:LoginStatus ID="LoginStatus1" runat="server" LogoutPageUrl="~/Logout.aspx" LogoutAction="Redirect" />
        <asp:Label ID="userName" runat="server"></asp:Label>
    </form>

code

        protected void Page_Load(object sender, EventArgs e)
        {
            if (!IsPostBack)
            {
                if (Request.IsAuthenticated)
                {
                    FormsIdentity identity = User.Identity as FormsIdentity;
                    string userName = User.Identity.Name;
                    string userData = identity.Ticket.UserData;
                    Literal lbUserData = LoginView1.FindControl("lbUserData") as Literal;
                    lbUserData.Text = userData;
                }
            }
        }

自定义IIdentity和IPrincipal接口，获取更多的用户信息

1. 添加App_code文件夹，其下添加文件CustomIdentity.cs、CustomPrincipal.cs
   

    public class CustomPrincipal: IPrincipal
    {
        private CustomIdentity identity;

        public CustomPrincipal(CustomIdentity identity)
        {
            this.identity = identity;
        }
        public IIdentity Identity
        {
            get
            {
                return identity;
            }
        }
        public bool IsInRole(string role)
        {
            return false;
        }
    }

public class CustomIdentity: IIdentity
    {
        private FormsAuthenticationTicket ticket;
        private HttpContext context = HttpContext.Current;

        public CustomIdentity(FormsAuthenticationTicket ticket)
        {
            this.ticket = ticket;
        }
        public string AuthenticationType
        {
            get { return "Custom"; }
        }
        public bool IsAuthenticated
        {
            get { return true; }
        }
        public string Name
        {
            get
            {
                return ticket.Name;
            }
        }

        public FormsAuthenticationTicket Ticket
        {
            get { return ticket; }
        }

        // 这里可以是任意来自数据库的值，由Name属性取得
        // 需要注意此时已通过身份验证
        public string Email
        {
            get
            {
                HttpCookie cookie = context.Request.Cookies["Email"];

                if (cookie == null || String.IsNullOrEmpty(cookie.Value))
                {
                    string email = "m3321414@163.com";   // 实际应根据name属性从数据库中获得
                    cookie = new HttpCookie("UserType", email);
                    context.Response.Cookies.Add(cookie);
                }

                return cookie.Value;
            }
        }
        //添加的属性
        public string DeptName
        {
            get
            {
                HttpCookie cookie = context.Request.Cookies["DeptName"];

                if (cookie == null || String.IsNullOrEmpty(cookie.Value))
                {
                    string DeptName = "开发部门";   // 实际应根据name属性从数据库中获得
                    cookie = new HttpCookie("UserType", DeptName);
                    context.Response.Cookies.Add(cookie);
                }

                return cookie.Value;
            }
        }

    }

1. Global.asax文件下添加认证模块
   

        protected void Application_OnPostAuthenticateRequest(object sender, EventArgs e)
        {
            IPrincipal user = HttpContext.Current.User;
            if (user.Identity.IsAuthenticated
                && user.Identity.AuthenticationType == "Forms")
            {

                FormsIdentity formIdentity = user.Identity as FormsIdentity;
                WebAppEmpty.App_Code.CustomIdentity identity = new CustomIdentity(formIdentity.Ticket);

                CustomPrincipal principal = new CustomPrincipal(identity);
                HttpContext.Current.User = principal;

                Thread.CurrentPrincipal = principal;
            }
        }

1. 页面获取数据

    CustomIdentity identity = User.Identity as CustomIdentity;
        if (identity != null)
        {
            // 获得UserData中的值
            string userData = identity.Ticket.UserData;
            Literal lbUserData = LoginView1.FindControl("lbUserData") as Literal;
            lbUserData.Text = userData;
            lbEmail.Text = identity.Email;
            lbDeptName.Text = identity.DeptName;
        }

通过用户ID获取用户信息

添加一个根据用户ID,获取用户信息的方法。每次获取调用。

转载于:https://www.cnblogs.com/LoveTomato/p/8119377.html