forms-authentication | 易学教程

Custom Forms Authentication + MVC3 + AuthorizeAttribute

阅读更多关于 Custom Forms Authentication + MVC3 + AuthorizeAttribute

问题 I am essentially doing is this. However, whenever I use the built in AuthorizeAttribute, the MVC framework (I'm guessing) never looks at my principal to determine if the user has the proper roles. It keeps trying to create a new MDF file in the app_data directory, and because it doesn't have privileged it blows up. Is this expected behavior, and should I derive my own AuthorizeAttribute and check the principal myself? Another weird behavior to point out is that I have two sites on the same

Two step authentication in MVC?

阅读更多关于 Two step authentication in MVC?

We have an MVC app which has a custom forms authentication view/controller. The controller will verify things and then do a FormsAuthentication.RedirectFromLoginPage call. At this point in the Global.asax we'll receive a Application_OnAuthenticateRequest call from where we'll get their Context.User information and make another call to gather information relevant to this account which we then store in their Context.User & System.Threading.Thread.CurrentPrincipal. We also do a little caching of this information since in our system retrieving what we need is expensive which leads to cache

securing ASP.NET forms authentication token on client side?

阅读更多关于 securing ASP.NET forms authentication token on client side?

问题 In my website, I am not using any authentication or authorization. I've created login page to capture the user credentials and check against database. If the user successfully authenticates, it's storing the user data in session and navigating to other pages. How thinking of implementing Forms Authentication, but my concern is how to secure the authentication token in client browser for security reasons. Does anyone have any ideas how to secure the authentication token? 回答1: Session: Fast,

Something like an operation filter in WCF REST?

阅读更多关于 Something like an operation filter in WCF REST?

问题 I am looking for something like the AuthorizeAttribute in MVC, something I can use like this: [WebGet(UriTemplate = "data/{spageNumber}")] [WebCache(CacheProfileName = "SampleProfile")] [WcfAuthorize] public IEnumerable<SampleItem> GetCollection(String spageNumber) { Int32 itemsPerPage = 10; Int32 pageNumber = Int32.Parse(spageNumber); return Enumerable.Range(pageNumber * itemsPerPage, itemsPerPage) .Select(i => SampleItem.Create(i)); } That WcfAuthorizeAttribute , will try to authenticate

How to use forms authentication without login control?

阅读更多关于 How to use forms authentication without login control?

问题 How to use forms authentication without login control.I don't want to use asp.net login control in my site.But i have to implement forms authentication and to validate users in my database. 回答1: I am assuming that instead of using a login control, you are using a few textboxes(eg username/password) and a logon button. The code could look something like this: In your aspx file <asp:Textbox runat="server" ID="Username"/> <asp:Textbox runat="server" ID="Password"/> <asp:Button runat="server" ID=

Context.User.Identity.Name vs HttpContext.Current.User.Identity.Name

阅读更多关于 Context.User.Identity.Name vs HttpContext.Current.User.Identity.Name

问题 In aspx.net, what is the difference between Context.User.Identity.Name and HttpContext.Current.User.Identity.Name Im currently using the Context.User.Identity.Name from a masterpage and are having trouble with user identitys beeing mixed up (user A sees user B data). Could this be the source of the problem? 回答1: They are identical. Context has a reference to the current HttpContext which is the same as HttpContext.Current . So, I don't think this is causing the problem that you are having.

ASP.Net Cross-Site Authentication

阅读更多关于 ASP.Net Cross-Site Authentication

I have a website using Forms Authentication on domain1.com. I've been asked how a login page can be developed on domain2.com which logs the user into domain1.com and redirects them to the domain1.com homepage (domain2.com has no membership system and is purely an alternative page to log in to domain1.com from). Is this possible out of the box or would I need to develop a page on domain1.com which authenticates the login request from domain2.com? Yes, you can reuse the auth page. Create a form in domain2.com pointing the auth uri in domain1.com Citing w3schools : the possible values of the

Why did ASP.NET generate the same cookie key for a domain and subdomain?

阅读更多关于 Why did ASP.NET generate the same cookie key for a domain and subdomain?

Bug: I've got an ASP.NET web application that occasionally sets identical cookie keys for ".www.mydomain.com" and "www.mydomain.com". I'm trying to figure out what default cookie domain ASP.NET sets, and how I accidentally coded the site to sometimes prepend a "." to the cookie domain. When 2 cookies have the same key and are sent up from the browser, the ASP.NET web application is unable to differentiate between the two because the domain value is not sent in the header. (See my previous question ) Evidence: I've enabled W3C logging on the web server and verified that both cookies are sent

Why doesn't WebSecurity.Logout immediately update IPrincipal.User to null user

阅读更多关于 Why doesn't WebSecurity.Logout *immediately* update IPrincipal.User to null user

问题 First of all it's important to note that in my application if you log out your session is still valid and you don't just get redirected back to a login page, but stay on the same page. With that said - whichever of these two ways I use to sign out in an MVC application FormsAuthentication.SignOut() WebSecurity.Logout() the effect is the same and neither of the following properties changes to reflect the logout if I immediately access them : User.Identity.Name Thread.CurrentPrincipal.Identity

Authentication in .NET Web API using MVC FormsAuthentication

阅读更多关于 Authentication in .NET Web API using MVC FormsAuthentication

问题 We have a single page application using the AngularJS framework that needs to talk to a API implemented in .NET Web API on a different domain. The problem The API is implemented in .NET Web API. To authenticate a user for access to our API we implemented the MVC Single Page Application template. This uses FormsAuthentication to grant acccess to the API. We used Fiddler to debug. When we visited a controller on the API that required authentication directly in the browser we could confirm that