成员身份（+ 角色）VS 会话状态 VS 表单身份验证
我正在考虑我的测试站点的登录和安全机制。目前情况如下：
- 数据库中有一个表，有3列（名称，密码，区分访问权限的数字）
- ，登录成功并分配访问权限后，创建会话，其中包含用户名和访问权限
- admin可以在任何地方访问，用户到某些页面而不是登录用户仅到欢迎和登录页面
- 每个页面都是从母版页继承的，其中有一些逻辑来检查会话
- 管理和用户特定页面具有控制机制来确定会话中当前用户的访问权限
我也尝试过使用成员资格和角色管理器执行此操作，但是由生成的数据库asp.net 是一个相当大的混乱（大量的表和每个表中的记录）。我不知道如何配置成员资格和角色，正如我上面所写的（意味着简单的表并使用我自己的登录控件）。
但成员资格和角色有一些优点（容易获得登录用户的数量、更少的代码、关闭页面/浏览器时自动注销、自动会话管理等......）。
我也在考虑表单身份验证，但我不确定是否有像会话和成员资格那样的灵活性。
I am considering Login and security mechanism at my testing site. Current situation is follows:
- there is a table in database, with 3 columns (name, password, number to differentiate between access rights)
- after successfull login and assigning access rights, session is created, with name of user and access rights
- admin has access everywhere, user to certain pages and not logged user only to welcome and login page
- every page is inherited from master page, where is some logic to check session
- admin and user specific pages have control mechanism to determine access rights of current user in session
I also tried do this with membership and roles manager, however the database generated by asp.net is quite a big mess (big number of tables and records in every table). I have no idea how to configure membership and roles as I wrote above (mean simple table and use my own login controls).
But there are some advantages of membership and roles (easy to get number of logged users, less code, automatic logoff when closing page/browser, automatic session management, etc ...).
I was also thinking about forms authentication, but I am not sure, if there is such flexibility like with session and membership.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
使用 Mebership 和 角色 管理员有很多好处。
然而，有时默认成员资格和角色提供者生成的数据还不够。
为此，如果您需要自己的数据，可以创建自定义成员资格、角色提供者和/或自定义成员资格用户源或自定义逻辑。
Using Mebership and Role manager has many benefits.
However sometimes the data generated by the default Membership and Role providers isn't sufficient enough.
For that purpose you can create custom membership, role providers and/or a custom membership user if you need your own data source or custom logic.
会员资格提供商已经涵盖了您想做的所有事情，使用起来非常简单。如果您不需要任何过于复杂或自定义的内容，我会认真建议您再次查看会员资格提供商，因为它完全可以做您想做的事情，并且已经过尝试和测试。不要为了它而重新发明轮子。
看看这些文章，它们详细介绍了整个事情：
检查 ASP.NET 的成员资格、角色和配置文件
Everything you want to do is already covered in the Membership provider which is very simple to use. If you do not need anything overly complex or custom I would seriously suggest looking again at the Membership provider as it would do exactly what you want to do, and it's tried and tested. Don't reinvent the wheel for the sake of it.
Take a look at these articles which cover the whole thing in good detail:
Examining ASP.NET's Membership, Roles, and Profile