ASP.NET Form验证随笔
以前的项目遇到用户验证问题全都采用windows验证方式，最近公司项目中要求采用Forms验证方式。
总结如下：
1.登录页面代码
protected void Button1_Click(object sender, EventArgs e)
{
FormsAuthenticationTicket ticket=new FormsAuthenticationTicket (1,"LoginName",DateTime.Now,DateTime.Now.AddMinutes(20),false,"aaa",FormsAuthentication.FormsCookiePath);
HttpCookie cookie=new HttpCookie(FormsAuthentication.FormsCookieName,FormsAuthentication.Encrypt(ticket));
if(ticket.IsPersistent)
{
cookie.Expires = ticket.Expiration;
}
Response.Cookies.Add(cookie);
Response.Redirect("admin_page1.aspx");
}
2. Webconfig代码
<authentication mode="Forms" >
<forms name="authTest" loginUrl="~/admin/admin_login.aspx" timeout="20">
</forms>
</authentication>
</system.web>
<location path="admin">
<system.web>
<authorization>
<allow roles="admin,aaa"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
3.Global文件代码
添加Application_AuthenticateRequest事件
if (HttpContext.Current.User != null)
{
if (HttpContext.Current.User.Identity.IsAuthenticated)
{
if (HttpContext.Current.User.Identity is FormsIdentity)
{
string userData;
string[] roles;
userData = string.Empty;
try
{
if (Request.Cookies["authTest"] != null)
{
FormsAuthenticationTicket ticket =
FormsAuthentication.Decrypt(Request.Cookies["authTest"].Value);
if (ticket != null)
{
userData = ticket.UserData;
}
}
}
catch (Exception E)
{
HttpContext.Current.Response.Write("<!-- " + E.Message + " -->");
}
roles = userData.Split(',');
HttpContext.Current.User = new GenericPrincipal(HttpContext.Current.User.Identity, roles);
}
}
}
到此完成了Forms验证。
但我有疑问：如果客户端禁用了cookie那么forms验证是否就失效了呢？