在 ASP.NET 中存储临时用户信息的最佳方式是什么？
当用户登录时，我需要从 ActiveDirectory 检索许多属性，例如他们的真实姓名、一些联系人等。我将经常以某些形式显示其中一些字段。在我的情况下，ActiveDirectory 检索速度非常糟糕，所以我想知道在登录时将这些信息存储在内存中，然后在注销/超时后将其删除的最佳方法是什么？
到目前为止我的想法： 1）存储在Session中，但是安全吗？ 2) 扩展 User.Identity 并将其存储在那里。不确定这是否可能。 3）将其存储在某种全局字典中。我如何知道他们已注销以删除键/值对？
我在这个项目中使用 MVC2，并且不需要写回 ActiveDirectory。
When user logs in there are number of attributes I need to retrieve from ActiveDirectory such as their real name, some contacts etc. Some of these fields I will be showing quite often in some forms. ActiveDirectory retrieval speed is pretty bad in my case, so I was wondering what would be the best way to store this information in memory when they log in, and then delete it once they log off/timeout?
My thoughts so far:
1) Store in Session, but is it safe?
2) Extend the User.Identity and store it there. Not sure that's possible.
3) Store it in some kind of global Dictionary. How would I know that they logged off to remove the key/value pair?
I am using MVC2 for this project and I will not need to write back to ActiveDirectory.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，正如据说您可以使用配置文件提供程序来存储数据。
我个人使用会话数据。
我的看法为什么：
1，通过将字段添加到配置文件中的数据库解决方案（如此处的additionalUserData = data）
使其易于使用，并且不需要很长时间即可实现会话处理。
2、会话数据始终在服务器上，您无需关心数据库中的数据，并且无需数据库即可工作。 （很少有项目是这样完成的）
它相当保存且易于访问，您可以添加到期日期时间。您还可以保留有关用户的更多信息。
第三个选项：
您必须有时间戳并检查每个已过期的请求并删除此记录，在这种情况下您必须为每个用户拥有字典...
问题是您的...
希望它有帮助
Yes as it is said you can use profile provider to store the data.
I personally use session data.
my view why:
1, Database solution via adding field into profile (as additionalUserData = data in here)
Make it simple to use and does not take long to implement as session handling.
2, session data are always on server and there for you do not need to care about data in database, and works without it. (few project has been done this way)
it is reasonably save and easy to access and you can add expiry date time. Also you can keep more information about the user.
3th option:
You would have to have timestamp and checking every request which has expired and remove this records in which case you would have to have dictionary for every user...
The problem is yours....
Hope it helps
只要数据量不是很大，我就会将其放入会话中。看起来它非常适合会话状态。如果您使用https，应该不会有任何安全问题。
如果您担心要放入会话状态的数据量，您还可以考虑使用 ASP.NET 配置文件提供程序，但您需要某种类型的机制来保持数据与 AD 同步（可能每次用户登录时）。话虽这么说，如果数据量不是很大，我认为会话是最好的选择。
I would put it in session as long as it's not a large amount of data. Seems like it's a perfect fit for session state. There shouldn't be any safety concerns if you use https.
If you're concerned about the amount of data you'd be putting in session state you could also consider using the ASP.NET Profile Provider but you'd need to have some type of mechanism to keep the data synched with AD (maybe each time the user logs in). That being said, if it's not a huge amount of data I think session is the way to go.
会话对象非常常用于存储信息。如果您担心安全性，可以使用 HTTPS 进行通信，也可以使用状态服务器或 SQL Server 来存储该信息。
Session objects are quite commonly used for storing information. If you are worried about security, you can use HTTPS for communication or you can make use of State Servers or SQL Server for storing that information.