forms-authentication | 易学教程

Implementing Forms authentication over async requests

阅读更多关于 Implementing Forms authentication over async requests

In an angular app with a .net web api backend, I'm trying to implement forms authentication over async requests. Here is the relevant portion of my web.config... <authentication mode="Forms"> <forms loginUrl="/" cookieless="UseCookies" name=".TIMETRACK" requireSSL="false" timeout="30" protection="All" path="/TimeTrack" /> </authentication> Here is my web api login method... [Route("Login")] public HttpResponseMessage Post(AppUser credentials) { var userTemplate = _authenticationProvider.GetUserByEmail(credentials.Email); var user = Mapper.Map<ClientUser>(credentials); if (userTemplate.HashCode

Auto logging in to another ASP.NET Application from main Web Application

阅读更多关于 Auto logging in to another ASP.NET Application from main Web Application

I'm running the latest version of YetAnotherForum in a folder beneath my main WebApplication. The subfolder is configured as an application in IIS and navigating to the folder and logging in works wonderfully. YAF is setup with a membership provider and uses Forms Authentication. What I'm trying to do now is to auto login a user into the forum from the main website. The main website uses custom authentication through sessions and cookies. It doesn't use any of the built in ASP.NET authentication or membership components. So basically what I want to happen is that when a user click on a link to

securing ASP.NET forms authentication token on client side?

阅读更多关于 securing ASP.NET forms authentication token on client side?

In my website, I am not using any authentication or authorization. I've created login page to capture the user credentials and check against database. If the user successfully authenticates, it's storing the user data in session and navigating to other pages. How thinking of implementing Forms Authentication, but my concern is how to secure the authentication token in client browser for security reasons. Does anyone have any ideas how to secure the authentication token? Session: Fast, Scalable, and Secure Session State Management for Your Web Applications Authentication: How To: Protect Forms

Add User Roles on Registration (Forms Authentication) MVC3

阅读更多关于 Add User Roles on Registration (Forms Authentication) MVC3

问题 I am developing an MVC 3 project and want to add a user to a role when they are registered, using Forms Authentication. So I'd like to create some check boxes, or a drop down list showing the roles, which are selected and the user is assigned to the role as they are registered. I have this code so far, which works: public ActionResult Register() { ViewData["roleName"] = new SelectList(Roles.GetAllRoles(), "roleName"); return View(); } And in the view I have: <label for="roleName">Select Role:

is it possible to use iis 7 to manage users when using forms authentication with asp.net

阅读更多关于 is it possible to use iis 7 to manage users when using forms authentication with asp.net

问题 I have an ASP.NET web application that is using forms authentication. Everything is configured and working correctly. However, i'm dealing with the issue of creating and maintaining users and role membership. I know that I can roll my own solution but I'm wondering if there is an alternative solution? Does iis7 provide screens for managing forms authentication users? Is there a reliable, free solution that someone would recommend? Thanks! 回答1: Not a solution, but a temporary workaround... In

ASP.NET: Authenticating user in code

阅读更多关于 ASP.NET: Authenticating user in code

I'm playing around with authentication and authorization to prepare for some task. I've created two pages: Login.aspx and Default.aspx. In config file i've set authentication to forms and denied unauthenticated users access: <authentication mode="Forms"> <forms name="aaa" defaultUrl="~/Login.aspx" /> </authentication> <authorization> <deny users="?"/> </authorization> Then I've written some simple code to authenticate my user in Login.aspx: protected void Page_Load(object sender, EventArgs e) { GenericIdentity identity = new GenericIdentity("aga", "bbb"); Context.User = new GenericPrincipal

Multiple applications on a single site - session and forms authentication scope

阅读更多关于 Multiple applications on a single site - session and forms authentication scope

问题 We're using ASP.NET and IIS 6.0. I realise that the definitions of applications, websites and virtual directories are ill-defined in IIS 6, and changed a lot in IIS 7. However, I'm stuck with IIS 6.0 for now. We have a single web site defined in IIS, and a number of separate sub-sites in Virtual Directories. The scheme looks like this:- http://site.example.com/site1 http://site.example.com/site2 .. etc .. site1, site2, ... are virtual directories in IIS 6.0, under the "Default Web Site". I

Override ASP.NET forms authentication for a single page

阅读更多关于 Override ASP.NET forms authentication for a single page

问题 In our ASP.NET MVC application, we automatically redirect users to a log-on page via the <authentication> section of <system.web> when they attempt to access an authorized-only page. The problem is that one action in the middle of the application, designed to be used by a tool, needs to return a straight-up HTTP 401 response on bad access. How can I return a real HTTP 401 code without the redirect for this specific action? 回答1: The following solution works, although I'm not at all sure it's

Custom Authorization (Permissions) ASP.NET MVC

阅读更多关于 Custom Authorization (Permissions) ASP.NET MVC

In my application a role has several permissions. And I want users to have access to actions dependent on permission, not the role. So suppose: Admin has perm1, perm2, perm3, SuperAdmin has all the permissons that admin has + perm4 and perm5. Also, there are some minor guys also who have perm1, perm3, perm6, perm7. I want to do the following: I want action to be accessible by guy who has suppose perm3 or perm4. those two permissions are from two different roles. but beside perm3 Admin has perm1 and perm2, this action will be also accessible by minor guys who have perm3 (its not obligatory to

How do I manage my authentication with WorldDomination and Nancy?

阅读更多关于 How do I manage my authentication with WorldDomination and Nancy?

问题 I'm trying to get social authentication working in an asp.net-hosted Nancy web app using the WorldDomination SimpleAuthentication plugin for Nancy. TL;DRs skip to the question bolded at the bottom of the question. Both are pretty nice, but there is a big documentation gap between the authentication process (well covered) and identifying the authenticated user during requests other than the initial authenticate request (nothing). Nancy provides for basic and forms authentication via additional