通过查询字符串进行 ASP.NET 表单身份验证
我目前在 IIS 7 上运行 ASP.NET 3.5 SP1。我已使用 .NET 成员身份启用了表单身份验证，并设置了一些根据我创建的角色进行限制的文件夹。 例如，如果匿名访问者尝试访问文件 http://www.example.com/ strict/foo.txt，他/她将按预期重定向到登录页面。 到目前为止，一切都很好。
我想做的是通过允许访问者在查询字符串中指定他们的登录凭据来提供对受保护文件的访问，仅此行：
http://www.example.com/foo.txt?user=username&pass=pwd
这可能吗？
I currently have an ASP.NET 3.5 SP1 running on IIS 7. I have enabled forms authentication using .NET Membership and setup some folders that are restricted according to roles I have created. For instance, if an anonymous visitor tries to access the file http://www.example.com/restricted/foo.txt, he/she will be redirected to a login page, as expected. So far so good.
What I would like to do is provide access to protected files by allowing visitors to specify their login credentials in a query string, something alone the lines of:
http://www.example.com/foo.txt?user=username&pass=pwd
Is this possible at all?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您应该能够编写一个 http 模块来拦截请求并根据查询字符串对用户进行身份验证。 然而，为了完整起见，我想问以明文形式向用户提供用户名和（特别是）密码是否是一个好主意。
you should be able to write an http module that intercepts the request and authenticates the user based on the querystring. However, just for the sake of completeness, I'd like to question whether it's a good idea to provide users their username and (in particular) password in plaintext.
您可以轻松创建一个下载页面，对用户进行身份验证，然后将其转发到所请求的文件。 例如导航到 Download.aspx?user=username&pass=pwd&file=foo.txt。
但不建议这样做。您永远不应该要求用户通过 URL 传递登录信息。
You could easily create a download page that would authenticate the user and then forward them to the requested file. Something like navigating to Download.aspx?user=username&pass=pwd&file=foo.txt.
This however is NOT recommended. You should never require users to pass login information via a URL.
基于您对其他问题的评论的第二个答案是，您可以简单地将下载页面放入目录中。 该子文件夹可能有一个 web.config，允许未经身份验证的用户访问其中的内容:-)
类似：
A secondary answer based on comments you've made to other questions is that you could simply put your download page in a directory. The subfolder could have a web.config that allows unauthenticated users access to the contents within :-)
something like: