MVC 基於FormsAuthentication 方式的權限驗證

1.登錄的代碼

[HttpPost]
        public ActionResult Index(User entity)
        {
            User user = GetUser(entity.Name, entity.Password);
            if (user != null)
            {
                FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                            1,
                            user.UserID.ToString(),
                            DateTime.Now,
                            DateTime.Now.AddMinutes(30),
                            false,
                            user.RoleNames.XJoin(","));
                string encTicket = FormsAuthentication.Encrypt(authTicket);
                HttpCookie cookie = HttpContext.Request.Cookies[FormsAuthentication.FormsCookieName];
                if (cookie == null)
                {
                    cookie = new HttpCookie(FormsAuthentication.FormsCookieName);
                }
                cookie.Value = encTicket;
                HttpContext.Response.AppendCookie(cookie);
                return RedirectToAction("Index", "Test");
            }
            return View();
        }

FormsAuthenticationTicket的user.RoleNames.XJoin(",")是我自己寫的擴展方法，表示用","分隔開的字符串。
生成票據

2.Global.asax中的代碼

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
        {
            if (HttpContext.Current.User != null)
            {
                if (HttpContext.Current.User.Identity.IsAuthenticated)
                {
                    if (HttpContext.Current.User.Identity is FormsIdentity)
                    {
                        FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;
                        FormsAuthenticationTicket ticket = id.Ticket;
                        string userData = ticket.UserData;

                        string[] roles = userData.Split(',');
                        HttpContext.Current.User = new GenericPrincipal(id, roles);
                    }
                }
            }
        }

給用戶票據的時候在里面加了一個字符串的角色信息，比如“Administrator”，當一個請求過來的時候asp.net會有一個Application_AuthenticateRequest的事件，專門用於用戶認證授權，在這個事件中我們只需要將這個字符表達的角色重建給用戶就可以，我們在Global.asax的Application_AuthenticateRequest方法中增加如下代碼

3.Controller中的代碼

    [Authorize(Roles="sysadmin")]
    public class TestController : Controller
    {
        public ActionResult Index()
        {
            return View();
        }
    }

Roles參數可以包含多個Role，比如（[Authorize(Roles="sysadmin,conadmin")]），Authorize屬性頁可以具體控制到某個action，只需要將其寫到對應Action方法的屬性上即可。

4.webConfig中的代碼

<authentication mode="Forms">
      <forms loginUrl="~/Login/Index" timeout="2880" />
</authentication>