如果我可以这样称呼它，这就是我的问题。我已经在 asp.net mvc 2.0 中使用自定义会员身份提供程序实现了身份验证。一切正常，但我有一个问题。当用户登录时，他提供了其用户名和密码，我检查了这一点通过 MSSQL 中的数据库，然后我验证用户并传递并使用 FormsAuthentication 仅将 UserName 设置为配置文件信息。
但是，当该用户想要创建仅属于他的新项目（比如说出售或其他东西）并且可以与用户创建的其他项目一起列出时，我可以使用此用户名（在 FormsAuthentication 中）在数据库中检查它并将该项目连接到具有外键的适当用户，但如果用户名是唯一的，则可以使用，因此我需要附加信息，例如数据库表“用户”中的 ID 列来存储和稍后使用它，那么存储用户附加信息的最安全和“最佳实践”方法是什么稍后使用它，因为我提到的用户名在数据库中必须是唯一的并且关于登录用户的信息还不够。
Here is my problem if i can call it that way.I have implemented authentification with custom memebership provider in asp.net mvc 2.0.Everything works well but i have one problem.When user log in he provides its username and password and i check this through databse in MSSQL then i validate user and pass and use FormsAuthentication to set only UserName as profile information.
But when that user wants to create new item(lets say for sale or something) that belongs only to him and can be listed with other items that user created i can use this username(in FormsAuthentication) check it in database and connect that item to appropriate user with foreign key but that works if username is unique so i need additional informations like ID column from database table "user" to store and use it later so what is the most secure and "best practice" way to store additional information of user and use it later because username as i mentioned must be unique in database and it is not enough information about logged user.
发布评论
评论（1）
您不能将 User 对象（或您拥有的任何附加信息）存储在 Session 中吗？或者在客户端使用cookie（如果您需要在用户关闭浏览器等之后保留登录状态）？如果您需要具体示例，请告诉我。
编辑：阅读您的评论后，如果您正在寻找“安全cookie”解决方案，请查看以下内容： http://www.codeproject.com/Articles/13665/HttpSecureCookie-A-Way-to-Encrypt-Cookies-with-ASP
我用它来存储用户的 id（仅他的ID）。当我检索这个 cookie 时，我会加载给定用户 ID 的用户。一些内存缓存允许我避免在每个请求上加载用户。
但只是想澄清一下，会话对象似乎非常适合您想要做的事情+您不必担心安全性（对于普通应用程序来说）。
Couldn't you store the User object (or whatever additional info you have) in the Session? or using a cookie at the client side (if you need to persist the login state even after the user closes his browser etc)? Let me know if you need specific examples.
EDIT: After reading your comments, if you are looking for a "secure cookie" solution have a look at this: http://www.codeproject.com/Articles/13665/HttpSecureCookie-A-Way-to-Encrypt-Cookies-with-ASP
I use it to store the user's id (only his id). When I retrieve this cookie I load the user given his id. Some in-memory caching allows me to avoid loading the user on each request.
But just wanted to clarify that the session object seems great for what you are trying to do + you dont have to worry about security (for the average app that is).