[转贴]Forms authentication and role-based security

// Create the authentication ticket

FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(

                                    1,                          //version

                                    txtUserName.Text,           // user name

                                    DateTime.Now,               // creation

                                    DateTime.Now.AddMinutes(60),//Expiration

                                    false,                      //Persistent

                                    String.Join( "|", roles));  // User data

 

// Now encrypt the ticket.

string encryptedTicket = FormsAuthentication.Encrypt(authTicket);

// Create a cookie and add the encrypted ticket to the cookie as data.

HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName,

                                                               encryptedTicket);

 

// Add the cookie to the outgoing cookies collection.

Response.Cookies.Add(authCookie);

 

// Redirect the user to the originally requested page

Response.Redirect(FormsAuthentication.GetRedirectUrl(txtUserName.Text, false));

Compare with the proposed approach:

 

// Get the cookie created by the FormsAuthentication API   // Notice that this cookie will have all the attributes according to     // the ones in the config file setting.         HttpCookie cookie = FormsAuthentication.GetAuthCookie( UserId.Text, false );   FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);     // Store roles inside the Forms Ticket with all the attributes aligned with   // the config Forms section.   FormsAuthenticationTicket newticket = new FormsAuthenticationTicket(                                                              ticket.Version,                                                               ticket.Name,                                                                  ticket.IssueDate,                                                             ticket.Expiration,                                                            ticket.IsPersistent,                                                          String.Join( "|", roles),                                                       ticket.CookiePath);             // add the encrypted ticket to the cookie as data.                                           cookie.Value = FormsAuthentication.Encrypt(newticket);   // Update the outgoing cookies collection.   Context.Response.Cookies.Set(cookie);     // Redirect the user to the originally requested page   Response.Redirect( FormsAuthentication.GetRedirectUrl( newticket.Name,                                                      newticket.IsPersistent ) );

<configuration>      <system.web>       <authentication mode="Forms">             <forms loginUrl="Secure/login.aspx"                   protection="All"                                requireSSL="true"                               timeout="10"                                    name="FormsAuthCookie"                            path="/FormsAuth"                               slidingExpiration="true" />        </authentication>     </system.web>  </configuration>

具体例子请参照http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT04.asp?frame=true