在客户端上访问 ASP.NET 身份验证票证（通过 javascript）

发布于 2024-08-22 15:00:06 字数 566 浏览 7 评论 0原文

我有一个使用表单身份验证的 ASP.NET 网站，

    <authentication mode="Forms">
        <forms name="NewsCoreAuthentication" loginUrl="~/Default.aspx" defaultUrl="~/Default.aspx" protection="Validation" timeout="300" domain="someRootDomain.com" />
    </authentication>

我需要确定用户在网页呈现给客户端后是否经过身份验证。为了实现这一点，我认为我可以读取 document.cookie 并检查“.ASPXAUTH”是否存在。但问题是，即使我签名了，这个值也是空。

如何检查用户是否已通过身份验证？为什么 document.cookie 为空？

谢谢您的解答。 blowdart 帮助我理解了为什么无法从客户端脚本访问身份验证票证。

原文

I have an ASP.NET website that uses Forms authentication

    <authentication mode="Forms">
        <forms name="NewsCoreAuthentication" loginUrl="~/Default.aspx" defaultUrl="~/Default.aspx" protection="Validation" timeout="300" domain="someRootDomain.com" />
    </authentication>

I need to identify if user is authenticated on web page after it was rendered to client.
To accomplish this I thought that I can read document.cookie and check if ".ASPXAUTH" is there.
But the problem is that even if I am signed in this value is empty.

How can I check that user is authenticated?
Why document.cookie is empty?

Thank you for answers. blowdart helped me to understand why authentication ticket is not accessible from client script.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

留蓝 2024-08-29 15:00:11

正如其他人所说，身份验证票是并且应该是 httponly。

执行此操作的最佳方法是使用 ApplicationServices。 JSON 身份验证端点公开 IsLoggedIn，我注意到您对服务器负载的担忧。调用静态端点来简单地检查 cookie 的开销可以忽略不计。真的。

因此，如果您使用MsAjax，只需启用应用程序服务并调用Sys.Services.AuthenticationService.IsLoggedIn。

如果您想从原始 javascript 执行此操作，这里是 codez ;-)

将此段添加到您的配置文件

  <system.web>
     ------------
  </system.web>
  <system.web.extensions>
    <scripting>
      <webServices>
        <authenticationService enabled ="true" requireSSL="false"/>
      </webServices>
    </scripting>
  </system.web.extensions>

页面....

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title></title>

    <script type="text/javascript">
        function createXHR() {
            // a memoizing XMLHttpRequest factory.
            var xhr;
            var factories = [
                    function() { return new XMLHttpRequest(); },
                    function() { return new ActiveXObject("Msxml2.XMLHTTP"); },
                    function() { return new ActiveXObject("Msxml3.XMLHTTP"); },
                    function() { return new ActiveXObject("Microsoft.XMLHTTP"); } ];
            for (var i = 0; i < factories.length; i++) {
                try {
                    xhr = factories[i]();
                    // memoize the factory so we don't have to look for it again.
                    createXHR = factories[i];
                    return xhr;
                } catch (e) { }
            }
        }

        function isLoggedIn() {
            var xhr = createXHR();
            xhr.open("POST", "/Authentication_JSON_AppService.axd/IsLoggedIn", true);
            xhr.onreadystatechange = function() {
                if (this.readyState === 4) {
                    if (this.status != 200) {
                        alert(xhr.statusText);
                    } else {
                        alert("IsLoggedIn = " + xhr.responseText);
                    }
                    xhr = null;
                }
            };
            xhr.setRequestHeader("content-type", "application/json");
            xhr.send(null);
        }
    </script>

</head>
<body>
    <input type="button" value="IsLoggedIn?" onclick="isLoggedIn()" />
</body>
</html>

As others have said, the auth ticket is and SHOULD be httponly.

The best way to do this is to use ApplicationServices. The JSON authentication endpoint exposes IsLoggedIn and I have noticed your concern regarding server load. The overhead of a call to a static endpoint that simply checks the cookie for you is negligible. Really.

So, If you are using MsAjax, just enable application services and call Sys.Services.AuthenticationService.IsLoggedIn.

If you want to do this from raw javascript here is the codez ;-)

Add this segment to you config file

  <system.web>
     ------------
  </system.web>
  <system.web.extensions>
    <scripting>
      <webServices>
        <authenticationService enabled ="true" requireSSL="false"/>
      </webServices>
    </scripting>
  </system.web.extensions>

The page....

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title></title>

    <script type="text/javascript">
        function createXHR() {
            // a memoizing XMLHttpRequest factory.
            var xhr;
            var factories = [
                    function() { return new XMLHttpRequest(); },
                    function() { return new ActiveXObject("Msxml2.XMLHTTP"); },
                    function() { return new ActiveXObject("Msxml3.XMLHTTP"); },
                    function() { return new ActiveXObject("Microsoft.XMLHTTP"); } ];
            for (var i = 0; i < factories.length; i++) {
                try {
                    xhr = factories[i]();
                    // memoize the factory so we don't have to look for it again.
                    createXHR = factories[i];
                    return xhr;
                } catch (e) { }
            }
        }

        function isLoggedIn() {
            var xhr = createXHR();
            xhr.open("POST", "/Authentication_JSON_AppService.axd/IsLoggedIn", true);
            xhr.onreadystatechange = function() {
                if (this.readyState === 4) {
                    if (this.status != 200) {
                        alert(xhr.statusText);
                    } else {
                        alert("IsLoggedIn = " + xhr.responseText);
                    }
                    xhr = null;
                }
            };
            xhr.setRequestHeader("content-type", "application/json");
            xhr.send(null);
        }
    </script>

</head>
<body>
    <input type="button" value="IsLoggedIn?" onclick="isLoggedIn()" />
</body>
</html>

回复收藏 0 原文