我一直在玩一些关于用C#制作数据库网站的MVC教程，并有一个问题是如何让用户使用用户名和密码登录后才能访问网站的某个部分。

我有一个登录页面（下面的代码），它接受用户名和密码，然后根据数据库记录验证用户。单击"登录"按钮后，返回的URL将带您进入网站的"管理"部分（完整路径为：http://localhost:53559/Data/update)。这一点我很满意。然而，我的问题是，如果你没有登录，"更新"页面仍然可以访问，也就是说，如果我在浏览器中输入上面的路径(http://localhost:53559/Data/update)如果不首先登录，它将加载没有问题）。

如何限制更新页面，使其仅在用户登录后可用？

（注意：完全初学者，请使用小单词！）

=================================================

登录的控制器代码：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using System.Web.Routing;
using System.Web.Security;
using DFAccountancy.Models;
namespace DFAccountancy.Controllers
{
public class AdminController : Controller
{
    //
    // GET: /Admin/LogOn
    public ActionResult LogOn()
    {
        return View();
    }
    //
    // POST: /Account/LogOn
    [HttpPost]
    public ActionResult LogOn(LogOnModel model, string returnUrl)
    {
        if (ModelState.IsValid)
        {
            if (Membership.ValidateUser(model.UserName, model.Password))
            {
                FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
                if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                    && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/''"))
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction("Update", "Data");
                }
            }
            else
            {
                ModelState.AddModelError("", "The user name or password provided is incorrect.");
            }
        }
        // If we got this far, something failed, redisplay form
        return View(model);
    }
    //
    // GET: /Account/LogOff
    public ActionResult LogOff()
    {
        FormsAuthentication.SignOut();
        return RedirectToAction("Index", "Home");
    }

=================================================

这是"更新"页面（即"管理"部分，只有在用户登录后才能访问）的查看代码：

@model DFAccountancy.Models.Data
@{
    ViewBag.Title = "Update";
}

<h2>Update</h2>
<script src="@Url.Content("~/Scripts/jquery.validate.min.js")" type="text/javascript">        </script>
<script src="@Url.Content("~/Scripts/jquery.validate.unobtrusive.min.js")"         type="text/javascript"></script>
<script type="text/javascript">
$(function () { $("#cl_button1").click(function () { $("#para1").val(""); }); });
$(function () { $("#cl_button2").click(function () { $("#para2").val(""); }); });
</script>
@using (Html.BeginForm()) {
@Html.ValidationSummary(true)
<fieldset>
    <legend>Data</legend>
    <div class="editor-label">
        @Html.LabelFor(model => model.para1)
    </div>
    <div class="editor-field">
        @Html.TextAreaFor(model => model.para1, new { cols = 75, @rows = 5 })
        @Html.ValidationMessageFor(model => model.para1)
    <input id="cl_button1" type="button" value="Clear Paragraph" />
    </div>
    <div class="editor-label">
        @Html.LabelFor(model => model.para2)
    </div>
    <div class="editor-field">
        @Html.TextAreaFor(model => model.para2, new { cols = 75, @rows = 5 })
        @Html.ValidationMessageFor(model => model.para2)
        <input id="cl_button2" type="button" value="Clear Paragraph" />
    </div>
    <p>
        <input type="submit" value="Update" />
        <input type="reset" value="Re-Set to begining" />
    </p>
</fieldset>
}
<div>
@Html.ActionLink("Back to List", "Index")
</div>

=================================================

这是位于更新视图页面后面的控制器代码（DataController）：

using System;
using System.Collections.Generic;
using System.Data;
using System.Data.Entity;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using DFAccountancy.Models;
namespace DFAccountancy.Controllers
{ 
    public class DataController : Controller
    {
    private DataDBContext db = new DataDBContext();
    //
    // GET: /Data/
    public ViewResult Index()
    {
        return View(db.Data.ToList());
    }
    //
    // GET: /Data/Details/5
    public ViewResult Details(string id)
    {
        Data data = db.Data.Find(id);
        return View(data);
    }

    //
    // GET: /Data/Update
    public ActionResult Update()
    {
        var model = db.Data.FirstOrDefault();
        return View(model);
    }
    //
    // POST: /Data/Update
    [HttpPost]
    //[Authorize(Roles = "Administrator")]  //Created Validataion so inaccessible from outside
    [ValidateInput(false)]
    public ActionResult Update(Data data)
    {
        if (ModelState.IsValid)
        {
            data.ID = 1; //EF need to know which row to update in the database.       
            db.Entry(data).State = EntityState.Modified;
            db.SaveChanges();
            return RedirectToAction("Index", "Home");
        }
        return View(data);
    }

}
}

[Authorize]
public class DataController : Controller
{...

[Authorize]
public ActionResult Update()
{...