.Net 会员资格的替代方案

发布于 2024-07-15 12:55:11 字数 176 浏览 5 评论 0原文

.net 会员资格有其他替代品\模组吗?

我发现它相当有限制性;

  • 无法轻松更改用户名。 您必须创建一个新用户并复制字段,但随后您会丢失主键,或者您必须自己直接编辑用户表。

  • 其他配置文件字段作为一个 blob 一起存储。

Are there any alternatives\mods to .net Membership?

I find it quite restrictive;

  • Cant change Username, easily. You have to create a new user and copy the fields, but then you lose the primary key OR you have to edit the user table directly yourself.

  • Additional profile fields are stored together as one blob.

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(5

ζ澈沫 2024-07-22 12:55:11

ASP.Net 成员资格使用提供者模型。 这意味着您可以完全自由地实现自己的会员资格提供程序,甚至继承并扩展现有的提供程序,只要您遵循 提供商合同

不过,另外一个是询问现有的替代方案,而不是尝试自己构建新的东西。

ASP.Net membership uses a provider model. That means you are completely free to implement your own membership provider, or even inherit from and extend an existing provider, as long as you follow the provider contract.

Plus one for asking about existing alternatives rather than trying to build something new yourself, though.

远山浅 2024-07-22 12:55:11

我将继续在这里列出我的替代方案。 我已经推出了自己的身份验证库,并且我认为它足以公开发布......所以我做到了。 它的设计是为了不妨碍你,总的来说,它非常简约。 我没有提供很多现成的用户控件,但在我见过的大多数网站上,这些内置用户控件从未被使用过。 因此,我没有尝试制作更灵活的用户控件,而是决定让创建自己的登录控件等变得非常简单。

该项目称为“快速、安全和简洁的身份验证”,简称 FSCAuth。 它是 BSD 许可的。 您可以在 BinpressBitbucket

它灵活的“UserStore”模型(表单相当于提供者)使您能够以任何您想要的方式形成数据库。 它可以支持纯文本文件、XML、MongoDBSql Server 以及介于两者之间的任何位置。

以下列出了我认为它比表单身份验证特别优越的事项:

  • 无状态身份验证系统。 不需要在数据库或内存中跟踪用户会话。 这使得扩展到多个服务器变得很简单,只需对身份验证代码进行少量(如果有)更改
  • 即可使用任何内容作为每个用户的唯一 ID。 没错,不再需要 GUID! 任何适合字符串的内容都是公平的 HTTP 基本身份验证游戏
  • 基本身份验证,并且您可以进行相同的调用,就像他们使用典型的基于 cookie 的身份验证一样
  • 。您可以仅在您想要的页面上(或全局)启用 使人没有安全感。 由于它的工作原理,并且我将尽可能少的核心代码留给最终用户来实际进行身份验证,因此它非常安全,并且将保持这种状态,除非您真的尝试破坏它。 我处理 cookie、HTTP 基本身份验证和所有哈希。 您只需为 FSCAuth 提供一个数据库即可将其放入。BCrypt
  • 对哈希值的支持很简单。 如何操作。。 在表单身份验证中,几乎不可能
  • 我喜欢它: )

当然它也有缺陷,公平地说,我将包括一些缺乏的东西

  • 在 IIS 6 中验证静态文件是不可能的(还)
  • 还没有暴力预防。 这意味着您需要确保同一个人不会在 2 秒内尝试访问您的登录页面 200 次。
  • 它没有内置到 ASP.Net 中,
  • 没有 Windows 或 Passport 身份验证(没有计划添加)

I'll go ahead and list my alternative here. I've rolled my own authentication library, and I think it's awesome enough to be publicly released... So I did. It's designed to stay out of your way and overall, it's pretty minimalistic. I don't provide a lot of out of the box user controls, but on most websites I've seen those built-in user controls are never used. So instead of trying to make yet more flexible user controls, I decided instead to make it brain-dead simple to create your own login controls and such.

The project is called Fast, Secure, and Concise Authentication, or FSCAuth for short. It is BSD licensed. You can download it over at Binpress or at Bitbucket

It's flexible "UserStore" model(the Form's equivalent of provider) enables you to form your database anyway you want. It can support plain text files, XML, MongoDB, Sql Server, and anywhere in-between.

Here's a list of things where I think it particularly excels over Forms Authentication:

  • Stateless Authentication System. There is no requirement to keep track of user sessions in either the database or memory. This makes it trivial to scale up to multiple servers requiring few(if any) changes to your authentication code
  • Use anything as a Unique ID for each user. That's right, no more GUIDs! Anything that will fit in a string is fair game
  • HTTP Basic Authentication baked in. You can enable Basic Authentication just on pages you want(or globally) and you can make the same calls as if they were using the typical cookie-based authentication
  • Hard to make insecure. Because of how it works and I leave as little core-code as possible to the end user for actually doing authentication, it's extremely secure and will stay that way unless you just really try to break it. I handle cookies, HTTP Basic Auth, and all hashing. You just give FSCAuth a database to put it in.
  • BCrypt support for hashes is trivial. How to do it.. In Forms Authentication it is almost not possible
  • I like it :)

Of course it's also lacking, and to be fair I'll include a few things that are lacking

  • Authenticating static files in IIS 6 isn't possible(yet)
  • There is no brute-force prevention(yet). This means that you'll need to make sure the same person isn't trying to hit your login page 200 times in 2 seconds.
  • It's not built into ASP.Net
  • No Windows or Passport authentication (with no plans to ever add)
羅雙樹 2024-07-22 12:55:11

由于 ASP.NET 成员资格模型是围绕提供者构建的,因此有许多可用的替代方案。

默认情况下,用户有一个 ProviderUserKey,它是一个 GUID,也是数据库的主键,因此如果需要,您应该能够编写一些内容来更改他们的用户名。

就配置文件而言,是的,默认的 blob 相当烦人。 您可以查看 SQL 表配置文件提供程序它将配置文件映射到表上,或者相当快地推出您自己的

As the ASP.NET membership model is built around Providers, there are a number of alternatives available.

By default, users have a ProviderUserKey, which is a GUID, and that's the Primary key of the database, so you should be able to write something to change their username if you want.

In terms of the profile, yes, the default blob is fairly annoying. You could take a look at the SQL Table Profile Provider which maps profiles on to tables, or fairly quickly roll your own.

难如初 2024-07-22 12:55:11

至于配置文件,有几个替代方案。 这两者要么使用表,要么让您调用存储过程。 当然你也可以自己实现。 我个人厌倦了使用配置文件提供程序,并发现在我的代码中处理配置文件更容易控制和包含。

至于其他问题,您也可以实现自己的提供程序。 Microsoft 向 SQL 提供程序发布了源代码,因此它可以为您提供一个起点。

As for the Profile there are a couple of alternatives out there. These two use either a table or let you call a stored procedure. Of course you can also implement your own. I personally got tired of using the Profile Providers, and found that dealing with the profile in my code was easier to control and contain.

As for the other issues, you can also implement your own provider. Microsoft released the source code to the SQL Providers so it can give you a starting point.

ま昔日黯然 2024-07-22 12:55:11

就更改用户名而言,可以通过使用 CreateNewUser() 方法并根据当前用户填写适当的字段,然后删除当前用户来轻松完成。

配置文件字段不是 .NET 成员资格提供程序模型的一部分,而是配置文件提供程序的一部分。 这是一个备受争议的话题,对于大多数生产机器来说,正确的方法是引入更好的配置文件提供程序解决方案,例如这个 表配置文件提供程序,它按照您的预期存储配置文件字段,而不是作为占用内存的 blob。 或者,您可以轻松推出自己的配置文件提供程序,请在此处查看说明

当然有 .NET Membership 替代方案,但大多数都存在缺陷或功能集较小。 在一个平台上开发两个月,然后意识到它不能支持你需要的所有功能,这真的很糟糕。 .NET 成员资格是一种经过验证的解决方案,这就是它如此频繁使用的原因。

As far as changing the username goes, that can easily be accomplished by using the CreateNewUser() method and filling in the appropriate fields based on the current User, and then deleting the current user.

Profile fields are not part of the .NET Membership Provider model, but part of the Profile Provider. This is a highly debated topic and for most production machines, the correct way to go is to drop-in a better profile provider solution, such as this Table Profile Provider, which stores profile fields as you'd expect rather than as a memory-hogging blob. Alternatively, you can easily roll your own profile provider, check out the instructions here.

There are certainly .NET Membership alternatives, but most are buggy or have a small featureset. It really sucks to develop on top of one for two months and then realize it won't support all the functionality you need. .NET Membership is a proven solution and that's why it is used so often.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文