是否有出售具有更高安全性的自定义 ASP.NET 会员提供商？
是否有出售具有更高安全性的自定义 ASP.NET 会员提供商？
例如，能够为密码重置随机呈现多个问题/答案、设置登录尝试次数、强制每 30 天重置一次密码、在一段时间内防止新密码出现重复密码等
Are there Custom ASP.NET Membership Providers for sale with added security?
For example, the ability to have multiple Questions/Answers that are randomly presented for Password reset, set number of login attempts, force password resets every 30 days, prevent duplicate passwords for new password for a certain period of time, etc
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我最近使用您请求的一些功能更新了我的自定义提供程序。 不幸的是，它并不完全出售，但我确实想告诉你，你自己做起来并不困难。
多个问题/答案功能和强制重置（密码过期）实际上可以使用任何提供商来实现，因为它们不是由提供商直接强制执行的。 要启用密码重置，您只需在 appSettings 中定义一个常量，即“PasswordLifetimeInDays”。 然后，在您的登录页面中，只需重写 Authenticate 方法并检查 MembershipUser 的 LastPasswordChange 属性。 如果他们的密码已过期，则将他们重定向到 ChangePassword 页面，否则请登录。查看 这篇文章 演示如何实现此功能。
预先生成的问题场景也并不真正适合提供者的功能。 不过，我认为第三方解决方案可以在单独的 API 中包含此机制。
SqlMembershipProvider 已经提供了一种通过 MaxInvalidPasswordAttempts 属性设置登录尝试次数的方法。
实际上，重复密码功能是唯一真正属于提供程序实现的部分，因为它需要一个额外的表来跟踪密码历史记录。
如果您决定自己实现这些内容，请告诉我，我可以提供更多指导。
I've recently updated my custom provider with some of your requested features. Unfortunately it's not exactly for sale, but I did want to tell you that it wouldn't be terribly difficult to do on your own.
The multiple question/answer feature and the force reset (password expiration) actually can be implemented using any provider because they're not directly enforced by the provider. To enable Password Resets you could simply define a constant in your appSettings, i.e. "PasswordLifetimeInDays". Then in your Login page simply override the Authenticate method and inspected the LastPasswordChange property of the MembershipUser. If their password has expired then redirect them to a ChangePassword page, otherwise log them in. Check out this article for a walk through of implementing this feature.
The pre-generated question scenario is also something that doesn't really fit in as provider functionality. Although, a third party solution could contain this mechanism in a separate API I suppose.
The SqlMembershipProvider already provides a way to set the number of login attempts via the MaxInvalidPasswordAttempts attribute.
Really, the duplicate passwords functionality is the only piece that truly belongs in the provider implementation as it requires an additional table to track the password history.
Let me know if you ever decide to implement this stuff on your own and I could offer some more guidance.