ASP.NET MVC 3数据库
使用Forms身份验证cookie
身份验证流程ide
1、用户登陆函数
一、验证表单:ModelState.IsValidui
二、验证用户名和密码:经过查询数据库验证加密
三、若是用户名和密码正确,则在客户端保存Cookie以保存用户登陆状态:SetAuthCookiespa
1):从数据库中查出用户名和一些必要的信息,并把额外信息保存到UserData中code
2):把用户名和UserData保存到 FormsAuthenticationTicket 票据中orm
3):对票据进行加密 Encrypt对象
4):将加密后的票据保存到Cookie发送到客户端
四、跳转到登陆前的页面
2、验证登陆
一、在Global中注册PostAuthenticateRequest事件函数,用于解析客户端发过来的Cookie数据
1):经过 HttpContext.Current.User.Identity 判断用户是否登陆(FormsIdentity,IsAuthenticated,AuthenticationType)
2):从HttpContext 的Request的Cookie中解析出Value,解密获得 FormsAuthenticationTicket 获得UserData
二、角色验证
在Action加入 Authorize特性,能够进行角色验证
在 HttpContext.Current.User 的 IsInRole 方法进行角色认证(须要重写)
下面是代码,以上用到的全部验证的类都进行重载
1、首先是用户用户身份认证的 IPrincipal
这里抽象出通用属性,定义两个 IPrincipal
//通用的用户实体 public class MyFormsPrincipal<TUserData> : IPrincipal where TUserData : class, new() { //当前用户实例 public IIdentity Identity { get; private set; } //用户数据 public TUserData UserData { get; private set; } public MyFormsPrincipal(FormsAuthenticationTicket ticket, TUserData userData) { if (ticket == null) throw new ArgumentNullException("ticket"); if (userData == null) throw new ArgumentNullException("userData"); Identity = new FormsIdentity(ticket); UserData = userData; } //角色验证 public bool IsInRole(string role) { var userData = UserData as MyUserDataPrincipal; if (userData == null) throw new NotImplementedException(); return userData.IsInRole(role); } //用户名验证 public bool IsInUser(string user) { var userData = UserData as MyUserDataPrincipal; if (userData == null) throw new NotImplementedException(); return userData.IsInUser(user); } }
通用实体里面能够存放数据实体,而且把角色验证和用户验证放到了具体的数据实体里面
//存放数据的用户实体 public class MyUserDataPrincipal : IPrincipal { //数据源 private readonly MingshiEntities mingshiDb = new MingshiEntities(); public int UserId { get; set; } //这里能够定义其余一些属性 public List<int> RoleId { get; set; } //当使用Authorize特性时,会调用改方法验证角色 public bool IsInRole(string role) { //找出用户全部所属角色 var userroles = mingshiDb.UserRole.Where(u => u.UserId == UserId).Select(u => u.Role.RoleName).ToList(); var roles = role.Split(new[] {','}, StringSplitOptions.RemoveEmptyEntries); return (from s in roles from userrole in userroles where s.Equals(userrole) select s).Any(); } //验证用户信息 public bool IsInUser(string user) { //找出用户全部所属角色 var users = user.Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries); return mingshiDb.User.Any(u => users.Contains(u.UserName)); } [ScriptIgnore] //在序列化的时候忽略该属性 public IIdentity Identity { get { throw new NotImplementedException(); } } }
2、用于验证和设置Cookie的 FormsAuthentication
//身份验证类 public class MyFormsAuthentication<TUserData> where TUserData : class, new() { //Cookie保存是时间 private const int CookieSaveDays = 14; //用户登陆成功时设置Cookie public static void SetAuthCookie(string username, TUserData userData, bool rememberMe) { if (userData == null) throw new ArgumentNullException("userData"); var data = (new JavaScriptSerializer()).Serialize(userData); //建立ticket var ticket = new FormsAuthenticationTicket( 2, username, DateTime.Now, DateTime.Now.AddDays(CookieSaveDays), rememberMe, data); //加密ticket var cookieValue = FormsAuthentication.Encrypt(ticket); //建立Cookie var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, cookieValue) { HttpOnly = true, Secure = FormsAuthentication.RequireSSL, Domain = FormsAuthentication.CookieDomain, Path = FormsAuthentication.FormsCookiePath, }; if (rememberMe) cookie.Expires = DateTime.Now.AddDays(CookieSaveDays); //写入Cookie HttpContext.Current.Response.Cookies.Remove(cookie.Name); HttpContext.Current.Response.Cookies.Add(cookie); } //从Request中解析出Ticket,UserData public static MyFormsPrincipal<TUserData> TryParsePrincipal(HttpRequest request) { if (request == null) throw new ArgumentNullException("request"); // 1. 读登陆Cookie var cookie = request.Cookies[FormsAuthentication.FormsCookieName]; if (cookie == null || string.IsNullOrEmpty(cookie.Value)) return null; try { // 2. 解密Cookie值,获取FormsAuthenticationTicket对象 var ticket = FormsAuthentication.Decrypt(cookie.Value); if (ticket != null && !string.IsNullOrEmpty(ticket.UserData)) { var userData = (new JavaScriptSerializer()).Deserialize<TUserData>(ticket.UserData); if (userData != null) { return new MyFormsPrincipal<TUserData>(ticket, userData); } } return null; } catch { /* 有异常也不要抛出,防止攻击者试探。 */ return null; } } }
3、用于验证角色和用户名的Authorize特性
//验证角色和用户名的类 public class MyAuthorizeAttribute : AuthorizeAttribute { protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext) { var user = httpContext.User as MyFormsPrincipal<MyUserDataPrincipal>; if (user != null) return (user.IsInRole(Roles) || user.IsInUser(Users)); return false; } protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext) { //验证不经过,直接跳转到相应页面,注意:若是不使用如下跳转,则会继续执行Action方法 filterContext.Result = new RedirectResult("http://www.baidu.com"); } }
好了,四个类定义完成,接下来是使用
一、首先是登录
[HttpPost] public ActionResult LogOn(LogOnModel model, string returnUrl) { if (ModelState.IsValid) {
//经过数据库查询验证 var bll= new UserBll(); var userId = bll.Validate(model.UserName, model.Password, HttpContext.Request.UserHostAddress, HttpContext.Request.UserAgent); if (userId > 0) { //验证成功,用户名密码正确,构造用户数据(能够添加更多数据,这里只保存用户Id) var userData = new MyUserDataPrincipal {UserId = userId}; //保存Cookie MyFormsAuthentication<MyUserDataPrincipal>.SetAuthCookie(model.UserName, userData, model.RememberMe); if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/") && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\")) { return Redirect(returnUrl); } else { return RedirectToAction("Index", "Home"); } } else { ModelState.AddModelError("", "提供的用户名或密码不正确。"); } } // 若是咱们进行到这一步时某个地方出错,则从新显示表单 return View(model); }
2、登录完成后,是验证,验证以前首先要得到客户端的用户数据(从以前设置的Cookie中解析)
在全局文件:Global.asax 中添加下面代码
protected void Application_PostAuthenticateRequest(object sender, System.EventArgs e) { var formsIdentity = HttpContext.Current.User.Identity as FormsIdentity; if (formsIdentity != null && formsIdentity.IsAuthenticated && formsIdentity.AuthenticationType == "Forms") { HttpContext.Current.User = MyFormsAuthentication<MyUserDataPrincipal>.TryParsePrincipal(HttpContext.Current.Request); } }
这样就从Request解析出了UserData,下面能够用于验证了
3、在须要验证角色的Action上添加 [MyAuthorize] 特性
[MyAuthorize(Roles = "User", Users = "bomo,toroto")] public ActionResult About() { return View(); }
当用户访问该Action时,调用 MyAuthorize 的 AuthorizeCore 方法进行验证, 若是验证成功,则继续执行,若是验证失败,会调用 HandleUnauthorizedRequest方法作相应处理,在MyAuthorize 中能够得到这里定义的 Roles 和 Users 进行验证