ASP.NET 2.0 会员资格：ValidateUser 未锁定用户？

发布于 2024-07-13 16:48:28 字数 976 浏览 11 评论 0原文

我在 ASP.NET 2.0 网站中使用默认的 SQLMembershipProvider，并期望 Membership.ValidateUser 在输入多次错误密码（在我的例子中为 5 个）后锁定用户，但 ValidateUser 似乎并不关心记录错误密码尝试次数并锁定用户。

怎么了？

我的 web.config 中的成员资格配置：

<membership defaultProvider="SqlMembershipProvider" >
   <providers>
     <clear />
      <add connectionStringName="ConnectionStringName" enablePasswordRetrieval="true"
         enablePasswordReset="true" requiresQuestionAndAnswer="false"
         requiresUniqueEmail="true" passwordFormat="Encrypted" maxInvalidPasswordAttempts="5"
         minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0"
         passwordAttemptWindow="10" passwordStrengthRegularExpression=""
         applicationName="MyApp" name="SqlMembershipProvider"
         type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
   </providers>
</membership>

原文

I am using the default SQLMembershipProvider in my ASP.NET 2.0 website, and expect the Membership.ValidateUser to lock-out the user after entering a number of wrong passwords (5, in my case) but ValidateUser doesn't seem to be caring about keeping count of bad password attempts and locking out the user.

What's wrong?

The Membership configuration in my web.config:

<membership defaultProvider="SqlMembershipProvider" >
   <providers>
     <clear />
      <add connectionStringName="ConnectionStringName" enablePasswordRetrieval="true"
         enablePasswordReset="true" requiresQuestionAndAnswer="false"
         requiresUniqueEmail="true" passwordFormat="Encrypted" maxInvalidPasswordAttempts="5"
         minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0"
         passwordAttemptWindow="10" passwordStrengthRegularExpression=""
         applicationName="MyApp" name="SqlMembershipProvider"
         type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
   </providers>
</membership>

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

帝王念 2024-07-20 16:48:28

PasswordAttemptWindow 和 MaxInvalidPasswordAttempts 设置为多少？这些配置设置是否在正确的 web.config 中设置？（测试环境实际使用的）

回复收藏 0 原文

雨后彩虹 2024-07-20 16:48:28

这是我的会员资格使用情况的配置，如果有任何用途，它可以按要求工作：

<membership defaultProvider="AspNetSqlMembershipProvider" userIsOnlineTimeWindow="30">
  <providers>
    <remove name="AspNetSqlMembershipProvider" />
    <!-- 
      Membership defaults mainly below this point:
      connString, reqQ&A - modified - all others currently default.
    -->
    <add connectionStringName="CustomSqlServerProvider"
          name="AspNetSqlMembershipProvider"
          type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
          enablePasswordRetrieval="false"
         enablePasswordReset="true"
         requiresQuestionAndAnswer="false"
         requiresUniqueEmail="false"
         passwordFormat="Hashed"
         maxInvalidPasswordAttempts="5"
         minRequiredPasswordLength="7"
         minRequiredNonalphanumericCharacters="1"
         passwordAttemptWindow="10"
         passwordStrengthRegularExpression=""
         applicationName="/" />
  </providers>
</membership>

另外，您是否尝试过使用 .Login() 方法进行身份验证过程？这就是我正在使用的而不是 validateuser()。

Here's the config for my membership usage which is working as required if it's of any use:

<membership defaultProvider="AspNetSqlMembershipProvider" userIsOnlineTimeWindow="30">
  <providers>
    <remove name="AspNetSqlMembershipProvider" />
    <!-- 
      Membership defaults mainly below this point:
      connString, reqQ&A - modified - all others currently default.
    -->
    <add connectionStringName="CustomSqlServerProvider"
          name="AspNetSqlMembershipProvider"
          type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
          enablePasswordRetrieval="false"
         enablePasswordReset="true"
         requiresQuestionAndAnswer="false"
         requiresUniqueEmail="false"
         passwordFormat="Hashed"
         maxInvalidPasswordAttempts="5"
         minRequiredPasswordLength="7"
         minRequiredNonalphanumericCharacters="1"
         passwordAttemptWindow="10"
         passwordStrengthRegularExpression=""
         applicationName="/" />
  </providers>
</membership>

Also, have you tried using the .Login() method for the authentication process instead? That's what i'm using rather than validateuser().

回复收藏 0 原文