MVC 基于FormsAuthentication 方式的权限验证

1.登录的代码

 1 [HttpPost]
 2         public ActionResult Index(User entity)
 3         {
 4             User user = GetUser(entity.Name, entity.Password);
 5             if (user != null)
 6             {
 7                 FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
 8                             1,
 9                             user.UserID.ToString(),
10                             DateTime.Now,
11                             DateTime.Now.AddMinutes(30),
12                             false,
13                             user.RoleNames.XJoin(","));
14                 string encTicket = FormsAuthentication.Encrypt(authTicket);
15                 HttpCookie cookie = HttpContext.Request.Cookies[FormsAuthentication.FormsCookieName];
16                 if (cookie == null)
17                 {
18                     cookie = new HttpCookie(FormsAuthentication.FormsCookieName);
19                 }
20                 cookie.Value = encTicket;
21                 HttpContext.Response.AppendCookie(cookie);
22                 return RedirectToAction("Index", "Test");
23             }
24             return View();
25         }

FormsAuthenticationTicket的user.RoleNames.XJoin(",")是我自己写的扩展方法，表示用","分隔开的字符串。
生成票据

2.Global.asax中的代码

 1 protected void Application_AuthenticateRequest(Object sender, EventArgs e)
 2         {
 3             if (HttpContext.Current.User != null)
 4             {
 5                 if (HttpContext.Current.User.Identity.IsAuthenticated)
 6                 {
 7                     if (HttpContext.Current.User.Identity is FormsIdentity)
 8                     {
 9                         FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;
10                         FormsAuthenticationTicket ticket = id.Ticket;
11                         string userData = ticket.UserData;
12 
13                         string[] roles = userData.Split(',');
14                         HttpContext.Current.User = new GenericPrincipal(id, roles);
15                     }
16                 }
17             }
18         }

给用户票据的时候在里面加了一个字符串的角色信息，比如“Administrator”，当一个请求过来的时候asp.net会有一个Application_AuthenticateRequest的事件，专门用于用户认证授权，在这个事件中我们只需要将这个字符表达的角色重建给用户就可以，我们在Global.asax的Application_AuthenticateRequest方法中增加如下代码

3.Controller中的代码

 1     [Authorize(Roles="sysadmin")]
 2     public class TestController : Controller
 3     {
 4         public ActionResult Index()
 5         {
 6             return View();
 7         }
 8     }

Roles参数可以包含多个Role，比如（[Authorize(Roles="sysadmin,conadmin")]），Authorize属性页可以具体控制到某个action，只需要将其写到对应Action方法的属性上即可。

4.webConfig中的代码

1 <authentication mode="Forms">
2       <forms loginUrl="~/Login/Index" timeout="2880" />
3 </authentication>