C# ASP.NET MVC 和登录身份验证

ASP.NET MVC and Login Authentication

提问by user239684

I have searched many posts here regarding custom user authentication but none have addressed all of my concerns

我在这里搜索了许多关于自定义用户身份验证的帖子，但没有一个能解决我所有的问题

I am new to ASP.NET MVC and have used traditional ASP.NET (WebForms) but don't know how build a login / authentication mechanism for a user using ASP.NET MVC.

我是 ASP.NET MVC 的新手，使用过传统的 ASP.NET (WebForms)，但不知道如何为使用 ASP.NET MVC 的用户构建登录/身份验证机制。

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
    string userName = Login1.UserName;
    string password = Login1.Password;
    bool rememberUserName = Login1.RememberMeSet;

    if (validateuser(userName, password))
    {
        //Fetch the role
        Database db = DatabaseFactory.CreateDatabase();


        //Create Command object
        System.Data.Common.DbCommand cmd = db.GetStoredProcCommand("sp_RolesForUser");
        db.AddInParameter(cmd, "@Uid", System.Data.DbType.String, 15);
        db.SetParameterValue(cmd, "@Uid", Login1.UserName);
        System.Data.IDataReader reader = db.ExecuteReader(cmd);
        System.Collections.ArrayList roleList = new System.Collections.ArrayList();
        if (reader.Read())
        {
            roleList.Add(reader[0]);
            string myRoles = (string)roleList[0];

            //Create Form Authentication ticket
            //Parameter(1) = Ticket version
            //Parameter(2) = User ID
            //Parameter(3) = Ticket Current Date and Time
            //Parameter(4) = Ticket Expiry
            //Parameter(5) = Remember me check
            //Parameter(6) = User Associated Roles in this ticket
            //Parameter(7) = Cookie Path (if any)
            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, userName, DateTime.Now,
            DateTime.Now.AddMinutes(20), rememberUserName, myRoles, FormsAuthentication.FormsCookiePath);

            //For security reasons we may hash the cookies
            string hashCookies = FormsAuthentication.Encrypt(ticket);
            HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hashCookies);

            // add the cookie to user browser
            Response.Cookies.Add(cookie);

            if (HttpContext.Current.User.IsInRole("Administrators"))
            {
                Response.Redirect("~/Admin/Default.aspx");
            }
            else
            {
                string returnURL = "~/Default.aspx";

                // get the requested page
                //string returnUrl = Request.QueryString["ReturnUrl"];
                //if (returnUrl == null)
                //   returnUrl = "~/Default.aspx";
                Response.Redirect(returnURL);
            }
        }
    }
}

  protected bool validateuser(string UserName, string Password)
  {
    Boolean boolReturnValue = false;

    //Create Connection using Enterprise Library Database Factory
    Database db = DatabaseFactory.CreateDatabase();

    //Create Command object
    DbCommand cmd = db.GetStoredProcCommand("sp_ValidateUser");

    db.AddInParameter(cmd, "@userid", DbType.String, 15);
    db.SetParameterValue(cmd, "@userid", Login1.UserName);

    db.AddInParameter(cmd, "@password", DbType.String, 15);
    db.SetParameterValue(cmd, "@password", Login1.Password);

    db.AddOutParameter(cmd, "@retval", DbType.Int16, 2);
    db.ExecuteNonQuery(cmd);

    int theStatus = (System.Int16)db.GetParameterValue(cmd, "@retval");

    if (theStatus > 0)  //Authenticated user
        boolReturnValue = true;
    else  //UnAuthorized...
        boolReturnValue = false;

    return boolReturnValue;
}

I don't really know how to translate that ASP.NET code into MVC-esque architecture; and I'm still at a loss on how to implement authentication in ASP.NET MVC.

我真的不知道如何将 ASP.NET 代码转换为 MVC 式架构；我仍然不知道如何在 ASP.NET MVC 中实现身份验证。

What do I need to do? How do I implement the above code in ASP.NET MVC? What am I missing from that code?

我需要做什么？如何在 ASP.NET MVC 中实现上述代码？我从那个代码中遗漏了什么？

回答by Dan Atkinson

Given your comments regarding tutorials, please see the asp.net/mvclearning section on security.

鉴于您对教程的评论，请参阅有关安全性的asp.net/mvc学习部分。

In particular, thistutorial on creating a secure ASP.NET MVC 5 web app with log in, email confirmation and password reset.

特别是，本教程是关于创建具有登录、电子邮件确认和密码重置的安全 ASP.NET MVC 5 Web 应用程序。

回答by Hamid Reza

You can write your authentication service by yourself. Here is a short story:

您可以自己编写身份验证服务。这是一个简短的故事：

Your user model class(i.e.)

您的用户模型类（即）

public class User
    {
        public int UserId { get; set; }
        public string Name { get; set; }
        public string Username { get; set; }
        public string Password { get; set; }
        public string Email { get; set; }
        public bool IsAdmin { get; set; }
    }

Your user repository class(i.e.)

您的用户存储库类（即）

 public class UserRepository
    {
        Context context = new Context();       
        public User GetByUsernameAndPassword(User user)
        {
            return context.Users.Where(u => u.Username==user.Username & u.Password==user.Password).FirstOrDefault();
        }
    }

And your user application class(i.e.)

和您的用户应用程序类（即）

public class UserApplication
    {
        UserRepository userRepo = new UserRepository();     
        public User GetByUsernameAndPassword(User user)
        {
            return userRepo.GetByUsernameAndPassword(user);
        }
    }

Here is your account controller(i.e.)

这是您的帐户控制器（即）

public class AccountController : Controller
    {
        UserApplication userApp = new UserApplication();
        SessionContext context = new SessionContext();

        public ActionResult Login()
        {
            return View();
        }
        [HttpPost]
        public ActionResult Login(User user)
        {
            var authenticatedUser = userApp.GetByUsernameAndPassword(user);
            if (authenticatedUser != null)
            {
                context.SetAuthenticationToken(authenticatedUser.UserId.ToString(),false, authenticatedUser);
                return RedirectToAction("Index", "Home");
            }

            return View();
        }

        public ActionResult Logout()
        {
            FormsAuthentication.SignOut();
            return RedirectToAction("Index", "Home");
        }

And your SessionContext class(i.e.)

和你的 SessionContext 类（即）

public class SessionContext
    {
        public void SetAuthenticationToken(string name, bool isPersistant, User userData)
        {
            string data = null;
            if (userData != null)
                data = new JavaScriptSerializer().Serialize(userData);

            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, name, DateTime.Now, DateTime.Now.AddYears(1), isPersistant, userData.UserId.ToString());

            string cookieData = FormsAuthentication.Encrypt(ticket);
            HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, cookieData)
            {
                HttpOnly = true,
                Expires = ticket.Expiration
            };

            HttpContext.Current.Response.Cookies.Add(cookie);
        }

        public User GetUserData()
        {
            User userData = null;

            try
            {
                HttpCookie cookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];
                if (cookie != null)
                {
                    FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);

                    userData = new JavaScriptSerializer().Deserialize(ticket.UserData, typeof(User)) as User;
                }
            }
            catch (Exception ex)
            {
            }

            return userData;
        }
    }

And finally add the following tag to your tag in web.config file:

最后将以下标签添加到 web.config 文件中的标签中：

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

And now you just need to insert [Authorize]attribute on the head of each controller that needs authentication.like this:

现在你只需要[Authorize]在每个需要身份验证的控制器的头部插入属性。像这样：

[Authorize]
public class ClassController : Controller
{
   ...
}

回答by Zeeshan

Code:

代码：

using Microsoft.AspNet.Identity;


if (Request.IsAuthenticated)
{
    return View();
}

回答by Diako Hasani

1-Add This Code To WebConfig

1-将此代码添加到 WebConfig

<system.web>

       <authentication mode="Forms">
       <forms loginUrl="/Log/Login" timeout="20"></forms>
       </authentication>

</system.web>

2-To Action Use This code

2-To Action 使用此代码

[HttpPost]
public async Task<ActionResult> Login(string UserName,string Password)
{
    var q = await userpro.Login(UserName, Password);
    if (q.Resalt)
    {

        //Add User To Cookie
        Response.Cookies.Add(FormsAuthentication.GetAuthCookie(UserName, false));

        return RedirectToAction("ShowUsers", "User");
    }
    else
    {
        ViewBag.Message = q.Message;
        return View();
    }

}

3-You Should Add This Attribute To Your Action [Authorize]

3-您应该将此属性添加到您的操作中 [Authorize]

4-To This Code You Can Get UserName In Cookie

4-通过此代码，您可以在 Cookie 中获取用户名

public async Task<ActionResult> ShowUsers(int Page = 0)
{
    string UserName= User.Identity.Name;
    return View(await user.GetAllUser(Page));
}