处理部分填写的表单的过期身份验证？
我有一个大型网络表单，希望在会话过期时提示用户登录，或者在提交表单时让他们登录。似乎让他们在提交表单时登录会带来很多挑战，因为他们会被重定向到登录页面，然后原始表单提交的回发数据会丢失。
所以我正在考虑如何在会话过期时提示他们异步登录。这样他们就停留在原始表单页面上，出现一个面板告诉他们会话已过期并且需要登录，它异步提交登录，登录面板消失，并且用户仍然在原始部分填写的表单上，并且可以提交它。使用现有的 ASP.NET 成员资格控件可以轻松实现此操作吗？当他们提交表单时，我需要担心会话密钥吗？我的意思是，我想知道表单提交的会话密钥是否是会话过期前的原始密钥，它与再次异步登录后生成的新密钥不匹配（我仍然不明白 ASP.NET 如何详细说明）跟踪身份验证/会话 ID）。
编辑：是的，我实际上担心身份验证过期。用户必须经过身份验证，提交的数据才被视为有效。
I have a large webform, and would like to prompt the user to login if their session expires, or have them login when they submit the form. It seems that having them login when they submit the form creates alot of challenges because they get redirected to the login page and then the postback data for the original form submission is lost.
So I'm thinking about how to prompt them to login asynchrounsly when the session expires. So that they stay on the original form page, have a panel appear telling them the session has expired and they need to login, it submits the login asynchronously, the login panel disapears, and the user is still on the original partially filled form and can submit it. Is this easily doable using the existing ASP.NET Membership controls? When they submit the form will I need to worry about the session key? I mean, I am wondering if the session key the form submits will be the original one from before the session expired which won't match the new one generated after logging in again asynchrounously(I still do not understand the details of how ASP.NET tracks authentication/session IDs).
Edit: Yes I am actually concerned about authentication expiration. The user must be authenticated for the submitted data to be considered valid.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
会话过期与身份验证过期不同 - 您可能需要确定您关心的是哪一个。
会话在不活动 20 分钟后（默认情况下）过期，并将清除
Session对象。当它过期时，您存储在Session中的任何内容都将消失。[表单] 身份验证在 30 分钟不活动后过期（默认情况下） - 尽管它仅在每个半衰期更新一次。因此，实际上 - 它可能会在 15 分钟不活动后过期（默认情况下）。当它过期时，下一个请求将被重定向到您的登录页面。
会话和身份验证并不真正相关 - 您可以是匿名（未经身份验证）用户，但仍然拥有
Session- 或者您可以登录（经过身份验证）但没有会话。您的会话可能会在您的身份验证之前过期，反之亦然。您可以简单地调高会话和/或身份验证的过期值。 Session 的问题在于它会占用服务器资源，并且保留 Authentication 是一个安全问题。
如果您只是担心在表单持续时间内保持它们都处于活动状态，则使用 XmlHttpRequest 或 iframe 访问服务器页面的一小段 JavaScript 将重置两者的过期时间（因为 slipExpiration ）。
还有其他技术，但首先更好地定义问题会很有帮助。
Session expiration is different than authentication expiration - you probably need to determine which you are concerned about.
Sessions expire after 20 minutes of inactivity (by default), and will clear the
Sessionobject. When it expires, anything you stashed intoSessionwill be gone.[Forms] Authentication expires after 30 minutes of inactivity (by default) - though it's only updated every half-life. So, in reality - it can expire after 15 minutes of inactivity (by default). When it expires, the next request will be redirected to your login page.
Session and Authentication aren't really related - you can be an anonymous (non-authenticated) user, and still have a
Session- or you can be logged-in (authenticated) but not have aSession. YourSessioncould expire before your authentication does, or vice-versa.You could simply crank up the values for expiration for Session and/or Authentication. The problem with Session is that it chews server resources, and keeping Authentication is a security problem.
If you're just concerned about keeping them both alive for the duration of your form, a small bit of JavaScript that hits a server page with XmlHttpRequest or an iframe will reset the expiration for both (because of slidingExpiration).
There's other techniques as well, but it'd be helpful to better define the issue first.
非常好的回应@Mark Brackett 阅读下面OP 的评论，我相信这是他的最终目标。
在按钮/提交元素上，您想要编写一个 javascript 方法，该方法通过 ajax 轮询服务器以查看它们是否仍然经过身份验证。
如果它们经过身份验证，您仍然希望返回 true 并让表单进行常规提交，如果返回 false，您希望不允许表单提交。此时，您将需要使用 javascript 在浏览器内显示一个“窗口”（想想浮动 div）或弹出一个真正的新窗口供他们登录（我推荐第一种方法），这个新窗口将允许他们通过ajax登录然后隐藏/关闭自身。
然后，当他们再次单击提交按钮时，该窗口就会消失，他们将能够成功发布表单。
Very nice response @Mark Brackett reading the OP's comment below I believe this is his end goal.
On the button / submit element you want to write a javascript method that via ajax will poll the server to see if they are still authenticated.
If they are auth'd still you want to return true and let the form do it's regular submission, if it returns false you want to not allow the form to submit. At this point you will want to use javascript to display either a "window" inside the browser (think floating div) or to pop up a true new window for them to log in (I'd recommend the first method) that this new window will allow them to login via ajax and then hide/close itself.
Then with that window gone when they click the submit button again they will be able to successfully post the form.
有很多方法可以做到这一点：您可以在用户的计算机上存储 cookie，或者您也可以将表单拆分为更小的表单（即：步骤 1 - 输入您的个人信息，步骤 2 - 输入帐单信息等）。
拆分表单可以让用户更快地输入数据，从而减少会话过期的机会。
添加 cookie 后，即使您事后登录，此人的信息仍然存在。只需确保最后取消设置这些cookie即可。
There are many ways of doing this: you may store a cookie on the user's computer, or you can also split the form into smaller forms (i.e.: step 1 - enter your personal information, step 2 - enter billing info, etc.).
Splitting your form makes it faster for a user to enter the data, thus reducing the chances for their session to expire.
Adding a cookie to this makes it so that the person's information is still there, even if you log in afterwards. Just make sure to unset these said cookies at the end.