Asp.net form-based permission method memo

Step 1:

Add the following to Web. config in the root directory:

<System. Web>

<Authentication mode = "forms">
<Forms loginurl = "login. aspx" defaulturl = "admin/admin. aspx" name = ". aspxformsauth">
</Forms>
</Authentication>

</System. Web>

Loginurl: The logon page to which the user has not logged on

Defaurl URL: After a correct logon, the webpage jumps to when no page is directed.

Step 2:

Create a web. config file in the admin folder and add the followingCode

<System. Web>
<! -- Reject anonymous users from accessing any files in this directory -->
<Authorization>
<Deny users = "? "/>
</Authorization>
</System. Web>

Deny users = "? ": Prohibit anonymous users from accessing any files in the Admin directory.

So far, as long as you access any file under admin, it will automatically jump to the login. aspx login page, requiring you to log on first, otherwise you do not want to see the page.

Step 3:

In the root directory, create the login. aspx login page (not in the Admin directory) and addTwo textbox controlsAndA botton Control, Which areUser Name,Password, AndLogin button

Double-click the login button and write the following in the login method:

Protected void btn_login_click (Object sender, eventargs E)
{
If (textbox1.text = "admin" & textbox2.text = "fenghua17173 ")
{
// "Notification" form verification. The user name has passed identity verification.
Formsauthentication. redirectfromloginpage (textbox1.text, true );
}
Else
{
Response. Write ("<SCRIPT> alert ('account or password is incorrect, Logon Failed! '); </SCRIPT> ");
}
}

OK. Now you are in login. on the ASPX page, fill in the account and password, and the system will follow the root path you entered in the root directory web. the defaulturl URL configured in config jumps to the past, that is, admin/admin. ASPX page.

Now all the pages under the Admin directory have passed identity authentication and obtained accessible tickets.

You can also use:

String user = "";
System. Web. Security. formsauthenticationticket TK = new system. Web. Security. formsauthenticationticket (1,
User,
Datetime. Now,
Datetime. Now. addminutes (3000000 ),
True,
"",
System. Web. Security. formsauthentication. formscookiepath
);

String key = system. Web. Security. formsauthentication. Encrypt (TK); // The encrypted ticket string.

Httpcookie ck = new httpcookie (system. Web. Security. formsauthentication. formscookiename, key );
Httpcontext. Current. response. Cookies. Add (CK );
Response. Redirect ("default. aspx ");

Last point:

Please do not forget to log on.Cancel, Which is simpler:

Add a Logout button to any page in the Admin directory and write it in the method:

// Exit the system and log out of the user
Protected void btn_logout_click (Object sender, eventargs E)
{
// Delete a User Ticket
Formsauthentication. signout ();
// Redirect to the login page
Formsauthentication. redirecttologinpage ();

}

 

Note:

<Authentication mode = "forms">

<Forms loginurl = "login. aspx"

Protection = "all"

Timeout = "30"

Name = "appnamecookie"

Path = "/formsauth"

Requiressl = "false"

Slidingexpiration = "true"

Defaulturl = "default. aspx"

Cookieless = "usecookies"

Enablecrossappredirects = "false"/>

</Authentication>

· Loginurl points to the logon page. You need to put it in a directory that supports SSL.

· Setting protection to "all" indicates that both data source authentication and encryption are enabled for authentication creden

· Timeout specifies the authentication survival time

· Name and path are set to unique values for the current application.

· Setting requiressl to "false" indicates disabling SSL encryption for cookies.

· If slidingexpiration is set to "true", the expiration time of each access will be reset.

· Defaulturl is setProgramHomepage

· Cookieless is set to "usecookies" to use cookies to pass authentication tickets

· Enablecrossappredirects is set to "false", indicating that the program does not accept external requests.