碼上快樂

相關內容    簡體    繁體

深入理解Forms 身份驗證

本文轉載自   查看原文   2017-12-13 16:11   1270    摘抄

本文將介紹.net中Form身份驗證的必要元素如FormsAuthentication.SetAuthCookie,FormsAuthentication.Encrypt,FormsAuthentication.Decrypt,machineKey,Identity,Principal等和.net如何定義和實現他們。 

一.介紹一些我們的應用場景吧 

index.aspx要求登陸，如果沒有登陸跳轉到login.aspx頁面，登錄成功后跳轉到index.aspx頁面，並顯示必要信息. 

二.實現： 

2.1 web.config:

  1. <system.web>      
  2.     <authentication mode="Forms">  
  3.         <forms name="adminlogin" loginUrl="login.aspx">  
  4.         </forms>  
  5.     </authentication>  
  6.     <authorization>  
  7.         <deny users="?"/>  
  8.     </authorization>  
  9. </system.web>  

注意：<authorization>          
<deny users="?"/>      
</authorization>  不是必須的。 

如果有的話，當我們訪問index.aspx時,.net底層負責檢測是否登錄，如果沒有登陸，.net根據我們的配置跳轉的login.aspx頁面。

如果沒有的話，必須我們自己寫必要的代碼，來跳轉。

2.2 login.aspx主要進行身份驗證，.net中有下列實現:

2.1.1 FormsAuthentication.RedirectFromLoginPage

  1. if (username == "admin" &&  password == "1")  
  2. {                  
  3.     
    FormsAuthentication.RedirectFromLoginPage(username, true);                  
  4. }  

該作用是設置票據，自動跳轉到來源頁面（index.aspx）.注意來源頁面必須帶一個ReturnUrl,否則會出錯  

  1. if (!User.Identity.IsAuthenticated)  
  2. {  
  3.     Response.Redirect("/login.aspx?ReturnUrl=/index.aspx");  
  4. }  

2.2.2 FormsAuthentication.SetAuthCookie 

  1. if (username == "admin" &&  password == "1")  
  2. {  
  3.     FormsAuthentication.SetAuthCookie(username, true);  
  4.     Response.Redirect("index.aspx");  
  5. }  

該方法比第一種方法有更大的靈活性，可以自定義登陸成功后，返回的url. 

2.2.3 自定義票據cookie 

  1. if (username == "admin" &&  password == "1")  
  2. {  
  3.     FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, username, DateTime.Now, DateTime.Now.AddMinutes(30), false, "Manager");  
  4.     string cookieStr = FormsAuthentication.Encrypt(ticket);  
  5.     HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, cookieStr);  
  6.     cookie.Expires = ticket.Expiration;  
  7.     cookie.Path = FormsAuthentication.FormsCookiePath;  
  8.     Response.Cookies.Add(cookie);  
  9.     Response.Redirect("index.aspx");                  
  10. }  

該方法比第二中方法又有更大的靈活性。 

2.3.1
FormsAuthentication.RedirectFromLoginPage的原理：

  1. public static void RedirectFromLoginPage(string userName, bool createPersistentCookie, string strCookiePath)  
  2.         {  
  3.             Initialize();  
  4.             if (userName != null)  
  5.             {  
  6.                 HttpContext current = HttpContext.Current;  
  7.                 string returnUrl = GetReturnUrl(true);  
  8.                 if (CookiesSupported || IsPathWithinAppRoot(current, returnUrl))  
  9.                 {  
  10.                     SetAuthCookie(userName, createPersistentCookie, strCookiePath);  
  11.                     returnUrl = RemoveQueryStringVariableFromUrl(returnUrl, FormsCookieName);  
  12.                     if (!CookiesSupported)  
  13.                     {  
  14.                         int index = returnUrl.IndexOf("://", StringComparison.Ordinal);  
  15.                         if (index > 0)  
  16.                         {  
  17.                             index = returnUrl.IndexOf('/', index + 3);  
  18.                             if (index > 0)  
  19.                             {  
  20.                                 returnUrl = returnUrl.Substring(index);  
  21.                             }  
  22.                         }  
  23.                     }  
  24.                 }  
  25.                 else  
  26.                 {  
  27.                     if (!EnableCrossAppRedirects)  
  28.                     {  
  29.                         throw new HttpException(System.Web.SR.GetString("Can_not_issue_cookie_or_redirect"));  
  30.                     }  
  31.                     HttpCookie cookie = GetAuthCookie(userName, createPersistentCookie, strCookiePath);  
  32.                     returnUrl = RemoveQueryStringVariableFromUrl(returnUrl, cookie.Name);  
  33.                     if (returnUrl.IndexOf('?') > 0)  
  34.                     {  
  35.                         string str2 = returnUrl;  
  36.                         returnUrl = str2 + "&" + cookie.Name + "=" + cookie.Value;  
  37.                     }  
  38.                     else  
  39.                     {  
  40.                         string str3 = returnUrl;  
  41.                         returnUrl = str3 + "?" + cookie.Name + "=" + cookie.Value;  
  42.                     }  
  43.                 }  
  44.                 current.Response.Redirect(returnUrl, false);  
  45.             }  
  46.         }  
  1. internal static string GetReturnUrl(bool useDefaultIfAbsent)  
  2. {  
  3.     Initialize();  
  4.     HttpContext current = HttpContext.Current;  
  5.     string str = current.Request.QueryString["ReturnUrl"];  
  6.     if (str == null)  
  7.     {  
  8.         str = current.Request.Form["ReturnUrl"];  
  9.         if ((!string.IsNullOrEmpty(str) && !str.Contains("/")) && str.Contains("%"))  
  10.         {  
  11.             str = HttpUtility.UrlDecode(str);  
  12.         }  
  13.     }  
  14.     if ((!string.IsNullOrEmpty(str) && !EnableCrossAppRedirects) && !UrlPath.IsPathOnSameServer(str, current.Request.Url))  
  15.     {  
  16.         str = null;  
  17.     }  
  18.     if (!string.IsNullOrEmpty(str) && CrossSiteScriptingValidation.IsDangerousUrl(str))  
  19.     {  
  20.         throw new HttpException(System.Web.SR.GetString("Invalid_redirect_return_url"));  
  21.     }  
  22.     if ((str == null) && useDefaultIfAbsent)  
  23.     {  
  24.         return DefaultUrl;  
  25.     }  
  26.     return str;  
  27. }  

本質上：FormsAuthentication.RedirectFromLoginPage是調用了FormsAuthentication.SetAuthCookie，然后Response.Redirect(current.Request.QueryString["ReturnUrl"],
false) 

2.3.2 FormsAuthentication.SetAuthCookie原理：

 

  1. public static void SetAuthCookie(string userName, bool createPersistentCookie, string strCookiePath)  
  2. {  
  3.     Initialize();  
  4.     HttpContext current = HttpContext.Current;  
  5.     if (!current.Request.IsSecureConnection && RequireSSL)  
  6.     {  
  7.         throw new HttpException(System.Web.SR.GetString("Connection_not_secure_creating_secure_cookie"));  
  8.     }  
  9.     bool flag = CookielessHelperClass.UseCookieless(current, false, CookieMode);  
  10.     HttpCookie cookie = GetAuthCookie(userName, createPersistentCookie, flag ? "/" : strCookiePath, !flag);  
  11.     if (!flag)  
  12.     {  
  13.         HttpContext.Current.Response.Cookies.Add(cookie);  
  14.         current.CookielessHelper.SetCookieValue('F', null);  
  15.     }  
  16.     else  
  17.     {  
  18.         current.CookielessHelper.SetCookieValue('F', cookie.Value);  
  19.     }  
  20. }  

 

  1. private static HttpCookie GetAuthCookie(string userName, bool createPersistentCookie, string strCookiePath, bool hexEncodedTicket)  
  2. {  
  3.     Initialize();  
  4.     if (userName == null)  
  5.     {  
  6.         userName = string.Empty;  
  7.     }  
  8.     if ((strCookiePath == null) || (strCookiePath.Length < 1))  
  9.     {  
  10.         strCookiePath = FormsCookiePath;  
  11.     }  
  12.     FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(2, userName, DateTime.Now, DateTime.Now.AddMinutes((double) _Timeout), createPersistentCookie, string.Empty, strCookiePath);  
  13.     string str = Encrypt(ticket, hexEncodedTicket);  
  14.     if ((str == null) || (str.Length < 1))  
  15.     {  
  16.         throw new HttpException(System.Web.SR.GetString("Unable_to_encrypt_cookie_ticket"));  
  17.     }  
  18.     HttpCookie cookie = new HttpCookie(FormsCookieName, str);  
  19.     cookie.HttpOnly = true;  
  20.     cookie.Path = strCookiePath;  
  21.     cookie.Secure = _RequireSSL;  
  22.     if (_CookieDomain != null)  
  23.     {  
  24.         cookie.Domain = _CookieDomain;  
  25.     }  
  26.     if (ticket.IsPersistent)  
  27.     {  
  28.         cookie.Expires = ticket.Expiration;  
  29.     }  
  30.     return cookie;  
  31. }  

FormsAuthentication.SetAuthCookie本質上調用了FormsAuthentication.GetAuthCookie,而FormsAuthentication.GetAuthCookie得代碼和我們上面跳到的第三種方法何其相似呀。

注意了：第二種方法和第三種方法還是有區別的。

a.第三種方法可以設置更多的信息如：

第二種：附加信息為string.Empty

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(2, userName,
DateTime.Now, DateTime.Now.AddMinutes((double) _Timeout),
createPersistentCookie, string.Empty,
strCookiePath);
第二種：附加信息為"Manager"
FormsAuthenticationTicket ticket = new
FormsAuthenticationTicket(1, username, DateTime.Now,
DateTime.Now.AddMinutes(30), false, "Manager"); 

b.第三種方法可以更靈活的設置domain等信息。

第二種使用的是默認的，如果在web.config配置了domain，就使用config中的 

  1. <authentication mode="Forms">  
  2.     <forms name="adminlogin" loginUrl="loginRedirect.aspx" domain ="bbs.it118.org">  
  3.     </forms>  
  4. </authentication>  

否則使用當前url的domain. 

但還是有個問題如果我在web.comfig
domain為bbs.it118.org的情況下，想設置domain為it118.org.第二種就必須如下寫了： 

  1. FormsAuthentication.SetAuthCookie(user.UserNumb, isSave == true);  
  2. string cookieName = FormsAuthentication.FormsCookieName;  
  3. HttpCookie cookie = HttpContext.Current.Response.Cookies[cookieName];  
  4. if (cookie != null)  
  5. {  
  6.      cookie.Domain = "it118.org";  
  7. }  

2.3.3我們在分析第三種方法的原理

//生成票據，帶有附加信息

 FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
username, DateTime.Now, DateTime.Now.AddMinutes(30), false, "Manager");

//加密票據
string cookieStr = FormsAuthentication.Encrypt(ticket);

//生成一個cookie,

//cookiename來自web.config配置的name 

  1. <authentication mode="Forms">  
  2.     <forms name="adminlogin" loginUrl="loginRedirect.aspx" domain ="bbs.it118.org">  
  3.     </forms>  
  4. </authentication>  

//cookie的值來自加密的票據
HttpCookie cookie = new
HttpCookie(FormsAuthentication.FormsCookieName, cookieStr); 

//設置cookie的過期時間和路徑等
               
cookie.Expires =
ticket.Expiration;
               
cookie.Path =
FormsAuthentication.FormsCookiePath;
               
Response.Cookies.Add(cookie);
               
Response.Redirect("index.aspx"); 

這里重點提一下加密算法 

  1. private static string Encrypt(FormsAuthenticationTicket ticket, bool hexEncodedTicket)  
  2.         {  
  3.             if (ticket == null)  
  4.             {  
  5.                 throw new ArgumentNullException("ticket");  
  6.             }  
  7.             Initialize();  
  8.             byte[] buf = MakeTicketIntoBinaryBlob(ticket);  
  9.             if (buf == null)  
  10.             {  
  11.                 return null;  
  12.             }  
  13.             if ((_Protection == FormsProtectionEnum.All) || (_Protection == FormsProtectionEnum.Validation))  
  14.             {  
  15.                 byte[] src = MachineKeySection.HashData(buf, null, 0, buf.Length);  
  16.                 if (src == null)  
  17.                 {  
  18.                     return null;  
  19.                 }  
  20.                 byte[] dst = new byte[src.Length + buf.Length];  
  21.                 Buffer.BlockCopy(buf, 0, dst, 0, buf.Length);  
  22.                 Buffer.BlockCopy(src, 0, dst, buf.Length, src.Length);  
  23.                 buf = dst;  
  24.             }  
  25.             if ((_Protection == FormsProtectionEnum.All) || (_Protection == FormsProtectionEnum.Encryption))  
  26.             {  
  27.                 buf = MachineKeySection.EncryptOrDecryptData(true, buf, null, 0, buf.Length, IVType.Random);  
  28.             }  
  29.             if (!hexEncodedTicket)  
  30.             {  
  31.                 return HttpServerUtility.UrlTokenEncode(buf);  
  32.             }  
  33.             return MachineKeySection.ByteArrayToHexString(buf, 0);  
  34.         }  

加密利用非對稱加密技術，其中的machinekey來自於web.config。  

  1. <machineKey validationKey="1E7A0332AD3930B95A82A1BFF82B041791366BD14DE8390B0B7EF3E7B05" decryptionKey="702BD19727054E63574" validation="SHA1"/>  

3.index.aspx  

  1. if (!User.Identity.IsAuthenticated)  
  2. {  
  3.     Response.Redirect("/login.aspx?ReturnUrl=/index.aspx");  
  4. }  
  5.   
  6. Response.Write("用戶名：" + User.Identity.Name  );  

當登陸成功后User.Identity.IsAuthenticated為true,User.Identity.Name為上述三種方法設置的username。

上面的這一切信息是“自動的”，至少我們不用編寫人任何代碼即可得到。太神奇了。記住：沒有自動的東西。要么自己寫要么是別的幫我們處理的。微軟一向助開發人員為快樂之本，一定是他干的。

 

  1.       
    private void OnAuthenticate(FormsAuthenticationEventArgs e)  
  2.        {  
  3.            HttpCookie cookie = null;  
  4.            if (this._eventHandler != null)  
  5.            {  
  6.                this._eventHandler(this, e);  
  7.            }  
  8.            if (e.Context.User == null)  
  9.            {  
  10.                if (e.User != null)  
  11.                {  
  12.                    e.Context.SetPrincipalNoDemand(e.User);  
  13.                }  
  14.                else  
  15.                {  
  16.                    FormsAuthenticationTicket tOld = null;  
  17.                    bool cookielessTicket = false;  
  18.                    try  
  19.                    {  
  20.                        tOld = ExtractTicketFromCookie(e.Context, FormsAuthentication.FormsCookieName, out cookielessTicket);  
  21.                    }  
  22.                    catch  
  23.                    {  
  24.                        tOld = null;  
  25.                    }  
  26.                    if ((tOld != null) && !tOld.Expired)  
  27.                    {  
  28.                        FormsAuthenticationTicket ticket = tOld;  
  29.                        if (FormsAuthentication.SlidingExpiration)  
  30.                        {  
  31.                            ticket = FormsAuthentication.RenewTicketIfOld(tOld);  
  32.                        }  
  33.                        e.Context.SetPrincipalNoDemand(new GenericPrincipal(new FormsIdentity(ticket), new string[0]));  
  34.                        if (!cookielessTicket && !ticket.CookiePath.Equals("/"))  
  35.                        {  
  36.                            cookie = e.Context.Request.Cookies[FormsAuthentication.FormsCookieName];  
  37.                            if (cookie != null)  
  38.                            {  
  39.                                cookie.Path = ticket.CookiePath;  
  40.                            }  
  41.                        }  
  42.                        if (ticket != tOld)  
  43.                        {  
  44.                            if ((cookielessTicket && (ticket.CookiePath != "/")) && (ticket.CookiePath.Length > 1))  
  45.                            {  
  46.                                ticket = new FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, ticket.UserData, "/");  
  47.                            }  
  48.                            string cookieValue = FormsAuthentication.Encrypt(ticket);  
  49.                            if (cookielessTicket)  
  50.                            {  
  51.                                e.Context.CookielessHelper.SetCookieValue('F', cookieValue);  
  52.                                e.Context.Response.Redirect(e.Context.Request.PathWithQueryString);  
  53.                            }  
  54.                            else  
  55.                            {  
  56.                                if (cookie != null)  
  57.                                {  
  58.                                    cookie = e.Context.Request.Cookies[FormsAuthentication.FormsCookieName];  
  59.                                }  
  60.                                if (cookie == null)  
  61.                                {  
  62.                                    cookie = new HttpCookie(FormsAuthentication.FormsCookieName, cookieValue);  
  63.                                    cookie.Path = ticket.CookiePath;  
  64.                                }  
  65.                                if (ticket.IsPersistent)  
  66.                                {  
  67.                                    cookie.Expires = ticket.Expiration;  
  68.                                }  
  69.                                cookie.Value = cookieValue;  
  70.                                cookie.Secure = FormsAuthentication.RequireSSL;  
  71.                                cookie.HttpOnly = true;  
  72.                                if (FormsAuthentication.CookieDomain != null)  
  73.                                {  
  74.                                    cookie.Domain = FormsAuthentication.CookieDomain;  
  75.                                }  
  76.                                e.Context.Response.Cookies.Remove(cookie.Name);  
  77.                                e.Context.Response.Cookies.Add(cookie);  
  78.                            }  
  79.                        }  
  80.                    }  
  81.               
    }  
  82.            }  
  83.        }  

 

  1. private static FormsAuthenticationTicket ExtractTicketFromCookie(HttpContext context, string name, out bool cookielessTicket)  
  2.        {  
  3.            FormsAuthenticationTicket ticket = null;  
  4.            string encryptedTicket = null;  
  5.            FormsAuthenticationTicket ticket2;  
  6.            bool flag = false;  
  7.            bool flag2 = false;  
  8.            try  
  9.            {  
  10.                try  
  11.                {  
  12.                    cookielessTicket = CookielessHelperClass.UseCookieless(context, false, FormsAuthentication.CookieMode);  
  13.                    if (cookielessTicket)  
  14.                    {  
  15.                        encryptedTicket = context.CookielessHelper.GetCookieValue('F');  
  16.                    }  
  17.                    else  
  18.                    {  
  19.                        HttpCookie cookie = context.Request.Cookies[name];  
  20.                        if (cookie != null)  
  21.                        {  
  22.                            encryptedTicket = cookie.Value;  
  23.                        }  
  24.                    }  
  25.                    if ((encryptedTicket != null) && (encryptedTicket.Length > 1))  
  26.                    {  
  27.                        try  
  28.                        {  
  29.                            ticket = FormsAuthentication.Decrypt(encryptedTicket);  
  30.                        }  
  31.                        catch  
  32.                        {  
  33.                            if (cookielessTicket)  
  34.                            {  
  35.                                context.CookielessHelper.SetCookieValue('F', null);  
  36.                            }  
  37.                            else  
  38.                            {  
  39.                                context.Request.Cookies.Remove(name);  
  40.                            }  
  41.                            flag2 = true;  
  42.                        }  
  43.                        if (ticket == null)  
  44.                        {  
  45.                            flag2 = true;  
  46.                        }  
  47.                        if (((ticket != null) && !ticket.Expired) && ((cookielessTicket || !FormsAuthentication.RequireSSL) || context.Request.IsSecureConnection))  
  48.                        {  
  49.                            return ticket;  
  50.                        }  
  51.                        if ((ticket != null) && ticket.Expired)  
  52.                        {  
  53.                            flag = true;  
  54.                        }  
  55.                        ticket = null;  
  56.                        if (cookielessTicket)  
  57.                        {  
  58.                            context.CookielessHelper.SetCookieValue('F', null);  
  59.                        }  
  60.                        else  
  61.                        {  
  62.                            context.Request.Cookies.Remove(name);  
  63.                        }  
  64.                    }  
  65.                    if (FormsAuthentication.EnableCrossAppRedirects)  
  66.                    {  
  67.                        encryptedTicket = context.Request.QueryString[name];  
  68.                        if ((encryptedTicket != null) && (encryptedTicket.Length > 1))  
  69.                        {  
  70.                            if (!cookielessTicket && (FormsAuthentication.CookieMode == HttpCookieMode.AutoDetect))  
  71.                            {  
  72.                                cookielessTicket = CookielessHelperClass.UseCookieless(context, true, FormsAuthentication.CookieMode);  
  73.                            }  
  74.                            try  
  75.                            {  
  76.                                ticket = FormsAuthentication.Decrypt(encryptedTicket);  
  77.                            }  
  78.                            catch  
  79.                            {  
  80.                                flag2 = true;  
  81.                            }  
  82.                            if (ticket == null)  
  83.                            {  
  84.                                flag2 = true;  
  85.                            }  
  86.                        }  
  87.                        if ((ticket == null) || ticket.Expired)  
  88.                        {  
  89.                            encryptedTicket = context.Request.Form[name];  
  90.                            if ((encryptedTicket != null) && (encryptedTicket.Length > 1))  
  91.                            {  
  92.                                if (!cookielessTicket && (FormsAuthentication.CookieMode == HttpCookieMode.AutoDetect))  
  93.                                {  
  94.                                    cookielessTicket = CookielessHelperClass.UseCookieless(context, true, FormsAuthentication.CookieMode);  
  95.                                }  
  96.                                try  
  97.                                {  
  98.                                    ticket = FormsAuthentication.Decrypt(encryptedTicket);  
  99.                                }  
  100.                                catch  
  101.                                {  
  102.                                    flag2 = true;  
  103.                                }  
  104.                                if (ticket == null)  
  105.                                {  
  106.                                    flag2 = true;  
  107.                                }  
  108.                            }  
  109.                        }  
  110.                    }  
  111.                    if ((ticket == null) || ticket.Expired)  
  112.                    {  
  113.                        if ((ticket != null) && ticket.Expired)  
  114.                        {  
  115.                            flag = true;  
  116.                        }  
  117.                        return null;  
  118.                    }  
  119.                    if (FormsAuthentication.RequireSSL && !context.Request.IsSecureConnection)  
  120.                    {  
  121.                        throw new HttpException(System.Web.SR.GetString("Connection_not_secure_creating_secure_cookie"));  
  122.                    }  
  123.                    if (cookielessTicket)  
  124.                    {  
  125.                        if (ticket.CookiePath != "/")  
  126.                        {  
  127.                            ticket = new FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, ticket.UserData, "/");  
  128.                            encryptedTicket = FormsAuthentication.Encrypt(ticket);  
  129.                        }  
  130.                        context.CookielessHelper.SetCookieValue('F', encryptedTicket);  
  131.                        string url = FormsAuthentication.RemoveQueryStringVariableFromUrl(context.Request.PathWithQueryString, name);  
  132.                        context.Response.Redirect(url);  
  133.                    }  
  134.                    else  
  135.                    {  
  136.                        HttpCookie cookie2 = new HttpCookie(name, encryptedTicket);  
  137.                        cookie2.HttpOnly = true;  
  138.                        cookie2.Path = ticket.CookiePath;  
  139.                        if (ticket.IsPersistent)  
  140.                        {  
  141.                            cookie2.Expires = ticket.Expiration;  
  142.                        }  
  143.                        cookie2.Secure = FormsAuthentication.RequireSSL;  
  144.                        if (FormsAuthentication.CookieDomain != null)  
  145.                        {  
  146.                            cookie2.Domain = FormsAuthentication.CookieDomain;  
  147.                        }  
  148.                        context.Response.Cookies.Remove(cookie2.Name);  
  149.                        context.Response.Cookies.Add(cookie2);  
  150.                    }  
  151.                    ticket2 = ticket;  
  152.                }  
  153.                finally  
  154.                {  
  155.                    if (flag2)  
  156.                    {  
  157.                        WebBaseEvent.RaiseSystemEvent(null, 0xfa5, 0xc419);  
  158.                    }  
  159.                    else if (flag)  
  160.                    {  
  161.                        WebBaseEvent.RaiseSystemEvent(null, 0xfa5, 0xc41a);  
  162.                    }  
  163.                }  
  164.            }  
  165.            catch  
  166.            {  
  167.                throw;  
  168.            }  
  169.            return ticket2;  
  170.        }  
  1.       
    internal void SetPrincipalNoDemand(IPrincipal principal, bool needToSetNativePrincipal)  
  2.        {  
  3.            this._user = principal;  
  4.            if ((needToSetNativePrincipal && this._isIntegratedPipeline) && (this._notificationContext.CurrentNotification == RequestNotification.AuthenticateRequest))  
  5.            {  
  6.                IntPtr zero = IntPtr.Zero;  
  7.                try  
  8.                {  
  9.                    IIS7WorkerRequest request = this._wr as IIS7WorkerRequest;  
  10.                    if (principal != null)  
  11.                    {  
  12.                        GCHandle handle = GCHandle.Alloc(principal);  
  13.                        try  
  14.                        {  
  15.                            zero = GCHandle.ToIntPtr(handle);  
  16.                            request.SetPrincipal(principal, zero);  
  17.                            return;  
  18.                        }  
  19.                        catch  
  20.                        {  
  21.                            zero = IntPtr.Zero;  
  22.                            if (handle.IsAllocated)  
  23.                            {  
  24.                                handle.Free();  
  25.                            }  
  26.                            throw;  
  27.                        }  
  28.                    }  
  29.                    request.SetPrincipal(null, IntPtr.Zero);  
  30.                }  
  31.                finally  
  32.                {  
  33.                    if (this._pManagedPrincipal != IntPtr.Zero)  
  34.                    {  
  35.                        GCHandle handle2 = GCHandle.FromIntPtr(this._pManagedPrincipal);  
  36.                        if (handle2.IsAllocated)  
  37.                        {  
  38.                            handle2.Free();  
  39.                        }  
  40.                    }  
  41.                    this._pManagedPrincipal = zero;  
  42.                }  
  43.            }  
  44.        }  

這段代碼邏輯挺簡單的： 

1.得到保存認證信息的cookie

2.解密

3.生成Principa Identity信息

4.賦值給context.user

這樣我們訪問User.Identity.IsAuthenticated
User.Identity.Name就自動有值了。


免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。



猜您在找 ASP.NET：Forms身份驗證和基於Role的權限驗證 使用authentication進行身份驗證,與Forms表單登陸 Asp.Net MVC 身份驗證-Forms [原創]采用Asp.Net的Forms身份驗證時，持久Cookie的過期時間會自動擴展 SharePoint 2013自定義Providers在基於表單的身份驗證（Forms-Based-Authentication）中的應用 WebService 之 身份驗證 MongoDB的身份驗證 Session 身份驗證 Godaddy身份驗證 Jwt身份驗證
 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM