如何正确实现会话的用户系统

发布于 2024-10-14 18:23:19 字数 645 浏览 5 评论 0原文

我以前从未真正实现过注册/登录系统，因此我正在尝试用 C#/ASP.NET 制作自己的注册/登录系统（不使用 ASP.NET 的内置会员提供程序）。我有点不清楚的是如何利用会话/cookies 来让用户在会话期间和会话之间保持登录状态。

protected void Login_User(object sender, EventArgs e)
{
    string username = usernameField.Text;
    string password = passwordField.Text;
    User user = UserRepository.FindUser(username);
    if (user != null)
    {
        if (user.Password.Equals(Hash(password)))
        {
            // How do I properly login the user and keep track of his session?
        }
        else
            Response.Write("Wrong password!");
    }
    else 
        Response.Write("User does not exist!");
}

原文

I've never actually implemented a registration/login system before, so I'm trying my hand at making my own in C#/ASP.NET (not using ASP.NET's built-in membership provider). What I'm a little unclear on is how to utilize Session/cookies to keep a user logged in during and between sessions.

protected void Login_User(object sender, EventArgs e)
{
    string username = usernameField.Text;
    string password = passwordField.Text;
    User user = UserRepository.FindUser(username);
    if (user != null)
    {
        if (user.Password.Equals(Hash(password)))
        {
            // How do I properly login the user and keep track of his session?
        }
        else
            Response.Write("Wrong password!");
    }
    else 
        Response.Write("User does not exist!");
}

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

懒的傷心 2024-10-21 18:23:19

对于正确的登录系统来说，它相当复杂。

创建继承 System.Security.Principal.IPrincipal 的类
另一个继承 System.Security.Principal.IIdentity 的类
将 IPrincipal 派生分配给 System.Web.HttpConext.Current.User
如果您不想使用 cookie，则将您的 IPrincipal 放入会话。
如果 HttpContext.Current.User 丢失，则通过从会话中获取重新分配（在第一个事件中，例如 page_init）。对于我的代码，我使用 FormsAuthenticationTicket 作为 cookie 并在 Global.asax 事件 PostAuthenticateRequest 上重新分配

使用 HttpContext.Current.User 的好处是您可以标记方法属性。

[Authorize] // authorized user only
public void btn_click(...){...}

我不确定正常的 asp.net 但它在 asp MVC 中工作得很好

如果你想使用 cookie，请尝试 System.Web.Securitiy.FormsAuthenticationTicket 和 FormsAuthentication

示例

public class WebUser:System.Security.Principal.IPrincipal
{
  ...
  public System.Security.Principal.IIdentity Identity{get; private set;}
  public WebUser(...)
  {
    this.Identity = new WebIdentity(...);
    HttpContext.Current.User = this;
  }
}
public class WebIdentity : System.Security.Principal.IIdentity
{
  ...
}

public void Login(...)
{
  var newUser = new WebUser(...);
}

its quite complicate for proper login system.

create class that inherit System.Security.Principal.IPrincipal
another class that inherrit System.Security.Principal.IIdentity
Assign IPrincipal derivative to System.Web.HttpConext.Current.User
if u dont want to use cookies then put your IPrincipal to Session.
if HttpContext.Current.User is lost then re-assign by get from session(in very first event eg. page_init). for my code, i use FormsAuthenticationTicket as cookie and reassign at Global.asax on event PostAuthenticateRequest

the good thing of using HttpContext.Current.User is u can mark method attribute.

[Authorize] // authorized user only
public void btn_click(...){...}

i'm not sure for normal asp.net but it work very well in asp MVC

if u want to use cookies, try System.Web.Securitiy.FormsAuthenticationTicket and FormsAuthentication

sample

public class WebUser:System.Security.Principal.IPrincipal
{
  ...
  public System.Security.Principal.IIdentity Identity{get; private set;}
  public WebUser(...)
  {
    this.Identity = new WebIdentity(...);
    HttpContext.Current.User = this;
  }
}
public class WebIdentity : System.Security.Principal.IIdentity
{
  ...
}

public void Login(...)
{
  var newUser = new WebUser(...);
}

回复收藏 0 原文

呆 2024-10-21 18:23:19

您可以使用 RedirectFromLogin 重定向到用户请求但无法访问的页面由于身份验证而进行访问，或者如果您想保持对用户重定向到的位置的控制，可以使用 SetAuthCookie

回复收藏 0 原文

⒈起吃苦の倖褔 2024-10-21 18:23:19

使用这个：

public class FormsAuthenticationService 
{
    public void SignIn(string userName, bool createPersistentCookie)
    {
        if (String.IsNullOrEmpty(userName)) throw new ArgumentException("Value cannot be null or empty.", "userName");

        FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);
    }

    public void SignOut()
    {
        FormsAuthentication.SignOut();
    }
}

Use this:

public class FormsAuthenticationService 
{
    public void SignIn(string userName, bool createPersistentCookie)
    {
        if (String.IsNullOrEmpty(userName)) throw new ArgumentException("Value cannot be null or empty.", "userName");

        FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);
    }

    public void SignOut()
    {
        FormsAuthentication.SignOut();
    }
}

回复收藏 0 原文

~没有更多了~