当我使用随机数据库列时,表单基础身份验证不起作用

本文关键字:表单 不起作用 身份验证 随机 数据库 | 更新日期: 2023-09-27 18:35:06

我正在使用SQL数据库的MVC表单基础自定义身份验证。我有CustomerRole名字的列。

我正在按以下方式检查授权:

测试控制器.CS

[Authorize]
public ActionResult Index()
{
    return View();
}
[Authorize(Roles="admin")]
public ActionResult AdminPage()
{
    return View();
}

帐户控制器.cs

[HttpPost]
public ActionResult Login(UserModel model, string returnUrl)
{
    // Lets first check if the Model is valid or not
    if (ModelState.IsValid)
    {
        using (userDbEntities entities = new userDbEntities())
        {
            string username = model.username;
            string password = model.password;
            // Now if our password was enctypted or hashed we would have          done the
            // same operation on the user entered password here, But for now
            // since the password is in plain text lets just authenticate directly
            bool userValid = entities.Tbl_UserMast.Any(user => user.UserName == username && user.UserPassword == password);
            // User found in the database
            if (userValid)
            {
                FormsAuthentication.SetAuthCookie(username, false);
                if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                 && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/''"))
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction("Index", "Home");
                }
             }
             else
             {
                 ModelState.AddModelError("", "The user name or password provided is incorrect.");
             }
          }
      }
      // If we got this far, something failed, redisplay form
      return View(model);
  }

所以当我去管理页面操作时。它向我表明我没有授权。
如果我将列名称更改为Roles,它正在工作。但是我不允许更改列名。有没有其他选择,我可以使用相同的列名使用授权

当我使用随机数据库列时,表单基础身份验证不起作用

您应该尝试自定义身份验证文件管理器
试试这个:

protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
{
    if (FormsAuthentication.CookiesSupported == true)
    {
        if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
        {
            try
            {
                //let us take out the username now                
                string username = FormsAuthentication.Decrypt(Request.Cookies[FormsAuthentication.FormsCookieName].Value).Name;
                string roles = string.Empty;
                using (userDbEntities entities = new userDbEntities())
                {
                    var user = entities.Users.SingleOrDefault(u => u.username == UserName);
                    roles = user.UserRole;
                }
                //let us extract the roles from our own custom cookie

                //Let us set the Pricipal with our user specific details
                HttpContext.Current.User  = new System.Security.Principal.GenericPrincipal(
                  new System.Security.Principal.GenericIdentity(username, "Forms"), roles.Split(';'));
            }
            catch (Exception)
            {
                //somehting went wrong
            }
        }
    }
}