ASP.NET 表单身份验证的工作原理：从请求中识别 cookie
我正在阅读 ASP.NET 中的表单身份验证，有些时候无法理解：
James 输入用户名密码，它们保存在数据库中。来自用户名的 cookie 被创建、加密并附加到响应中。据我了解，当我们收到请求时，我们需要识别收到的 cookie 是来自 James，这样我们就可以显示他的自定义页面。
我想了解的是系统如何从 cookie 中检索用户名，然后从数据库加载他的信息？
I am reading on form authentication in ASP.NET and cannot understand some moment:
James enters a username-password, they are saved in the db. A cookie from username is created, encrypted and attached to a response. As I understand then, when we get a request we need to recognise that cookie received are from James and so we can show his customised page.
What I would like to understand is how system will retrieve username form cookie and then load his info from db?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Forms Auth 与存储无关。它不必使用数据库，实际上您可以在 web.config。
那么会发生什么情况是
在您的代码中，您可以检查用户 Page 类 (WebForms) 中的属性或 控制器中的 User 属性类（MVC）。
虽然您可以通过当前线程或当前上下文获取它，但不建议这样做，特别是一旦您开始使用后台任务，其中身份可能不会传播到线程，或者上下文可能会更改。
您会注意到，当用户登录时，数据库中不会存储任何内容。这一切都在表单身份验证令牌中，并且在每个请求上从其存储中检索用户的工作都已为您完成。
Forms Auth is storage agnostic. It doesn't have to use a database, indeed you can use it with usernames and passwords in web.config.
So what happens is
In your code you can check the User property in the Page class (WebForms) or the User property in the controller class (MVC).
While you can get at it via the current thread, or the current context it's not advised, especially once you start using background tasks, where the identity may not propagate to the thread, or the context may change.
You'll note that nothing is stored in a database when the user logs in. It's all in the forms authentication token, and the work of retrieving the user from it's store on each request is done for you.
Afaik Forms Authentication 不会在任何数据库中存储或加载任何内容。您可以使用数据库来存储用户名和密码，也可以将它们放在 web.config 中。如何存储用户凭据并验证它们取决于您，并且可以与表单身份验证分开进行。
一旦您验证了用户（针对数据库或其他一些逻辑存储），您就可以使用 FormsAuthentication 来写入身份验证 cookie。您无需担心 cookie 的解密问题。
您可以从 System.Threading.Thread.CurrentPrincipal.Identity.Name 获取用户名。要从数据库检索用户信息，您可以使用主体身份名称的值查询数据库。
回复评论
是的，您可以将表单身份验证与成员资格提供商、活动目录或您自己的自定义用户数据库结合使用。 FormsAuth 根本不关心密码，除非它存储在 web.config 中（如blowdart 更完整的答案中所述）。它只是写入 cookie，该 cookie 被解密并用于自动创建线程标识。
其他信息
尽管这被标记为答案，但blowdart的响应要完整得多。如果您在 ASPX 页面或 MVC 控制器中需要它，您确实不应该从线程获取身份，请使用他引用的属性。
Afaik Forms Authentication does not store or load anything in any database. You can use a database to store the username and password, or you can put them in the web.config. How you store user credentials and validate them is up to you, and can happen separately from Forms Authentication.
Once you have validated a user (against database or some other logical storage), you use FormsAuthentication to write the authentication cookie. You do not need to worry about decrypting the cookie.
You can get the username from System.Threading.Thread.CurrentPrincipal.Identity.Name. To retrieve user's info from the database, you would query the database using the value if the principal identity name.
Response to comments
Right, you can use forms authentication with the membership provider, active directory, or your own custom user database. FormsAuth doesn't care about the password at all, unless it is stored in web.config (as noted in blowdart's more complete answer). It just writes the cookie, which is decrypted and used to create the thread identity automatically.
Additional Info
Even though this was marked as the answer, blowdart's response is much more complete. You really should not get the identity from the thread if you need it in an ASPX page or MVC controller, use the properties he referenced.
您可以通过调用 User.Identity.Name 在 Web 表单中获取用户名，例如：
ASP.NET 会为您解释 cookie，您不必自己读取它。或者您的问题是如何在数据库中存储用户和密码？
You get the username in your web form by calling User.Identity.Name, e.g. like this:
ASP.NET interprets the cookie for you, you don't have to read it yourself. Or is your question how to store the user and password in the DB?