How can I manually create a authentication cookie instead of the default method?
How can I manually create a authentication cookie instead of the default method?
Here you go. ASP.NET takes care of this for you when you use the higher level methods built into FormsAuthentication, but at the low level this is required to create an authentication cookie.
if (Membership.ValidateUser(username, password)) { // sometimes used to persist user roles string userData = string.Join("|",GetCustomUserRoles()); FormsAuthenticationTicket ticket = new FormsAuthenticationTicket( 1, // ticket version username, // authenticated username DateTime.Now, // issueDate DateTime.Now.AddMinutes(30), // expiryDate isPersistent, // true to persist across browser sessions userData, // can be used to store additional user data FormsAuthentication.FormsCookiePath); // the path for the cookie // Encrypt the ticket using the machine key string encryptedTicket = FormsAuthentication.Encrypt(ticket); // Add the cookie to the request to save it HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket); cookie.HttpOnly = true; Response.Cookies.Add(cookie); // Your redirect logic Response.Redirect(FormsAuthentication.GetRedirectUrl(username, isPersistent)); }
I'm not sure why you would want to do something custom here. If you want to change the implementation of where user data is stored and how users authenticate then it's best practice to create a custom MembershipProvider
. Rolling your own solution and messing with the authentication cookie means a high probability of introducing security holes in your software.
I don't understand your part 2. You only need to call FormsAuthentication.GetRedirectUrl if you want to return users to the page they were trying to access when they got bounced to login. If not do whatever you want here, redirect to a url stored in the configuration if you want.
To read the FormsAuthentication cookie, normally you would hook the AuthenticateRequest
event in a HttpModule or the Global.asax and set up the user IPrinciple
context.
protected void Application_AuthenticateRequest(Object sender, EventArgs e) { HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName]; if(authCookie != null) { //Extract the forms authentication cookie FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value); // If caching roles in userData field then extract string[] roles = authTicket.UserData.Split(new char[]{'|'}); // Create the IIdentity instance IIdentity id = new FormsIdentity( authTicket ); // Create the IPrinciple instance IPrincipal principal = new GenericPrincipal(id, roles); // Set the context user Context.User = principal; } }
作者:Chuck Lu GitHub |
【推荐】国内首个AI IDE,深度理解中文开发场景,立即下载体验Trae
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 记一次.NET内存居高不下排查解决与启示
· 探究高空视频全景AR技术的实现原理
· 理解Rust引用及其生命周期标识(上)
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
· 没有源码,如何修改代码逻辑?
· 全程不用写代码,我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了,比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· DeepSeek 开源周回顾「GitHub 热点速览」
· 白话解读 Dapr 1.15:你的「微服务管家」又秀新绝活了
2019-01-13 CodeWars上的JavaScript技巧积累
2019-01-13 What's the difference between using “let” and “var” to declare a variable in JavaScript?
2015-01-13 Covariance and Contravariance (C#)
2015-01-13 Excel导出失败的提示