Use httpmodule for role-based authentication

Use httpmodule for role-based authentication

Recently usedHttpmoduleImplements a role-based identity authentication. I willCodePost it, and you are welcome to criticize and correct it.ProgramIs usedAsp.net 2.0. AboutHttpmoduleThere are a lot of information on the Internet, I will not introduce it here :)

First, createCSFile:Authenticatemodule. CS. Create a class in it:Authenticatemodule, Implementation of this classIhttpmoduleInterface.VSWill automatically addIhttpmoduleTwo Methods of the interface:Globe. asaxBut put it inGlobe. asaxFile, it will be compiled together with the website program. If the authentication module needs to be maintained in the future, the website program will be re-compiled. The authentication module is compiled into a separateDLLFile. And thisDLLFiles can be used in different programs later)

Public void dispose ()AndPublic void Init (httpapplication context)

InInitAdd the following code:

Context. prerequesthandlerexecute + = new eventhandler (context_prerequesthandlerexecute );

Why?PrerequesthandlerexecuteEvent processing, because I need to store user identity information inSessionFor example, user name and user role (marked with strings, for example:Administrator,Operator). WhileSessionOnlyAcquirerequeststateEvent. WhilePrerequesthandlerexecuteThe event is inAcquirerequeststateEvent. See:

Http://msdn.microsoft.com/library/default.asp? Url =/library/en-US/cpguide/html/cpconhandlingpublicevents. asp

The verification method is as follows:

 

Void Context_prerequesthandlerexecute ( Object Sender, eventargs E)
... {
Httpapplication = (Httpapplication) sender;
Httpcontext Context = Application. context;
/**/ /*
Obtain an instance that implements the imemebermanage Interface
Imemebermanage is a custom interface. Its main function is to determine the user
Whether the requested page is accessible by its role.
*/
Imemebermanage im = Membermanagementloader. getinstance ();


String Relativeurl = Context. Request. url. absolutepath. Replace ( " /Pacificadmin " , " ~ " );

// Only requests of the aspx type are judged.
If (Context. Request. url. absolutepath. endswith ( " . Aspx " ))
... {
/**/ /*
Session ["userinfo"] is empty, indicating that the user has not logged on
Or the seesion becomes invalid after logon. navigate to the logon page and record the user request page to the querystring named redirectpath. After the user authenticates, will automatically navigate to this page
*/
If (Context. session [ " Userinfo " ] = Null )
... {
/**/ /*
Determine whether the requested page is "unprotected page"
"Unprotected pages" are accessible without authentication. For example:
Logon page, error page, etc.
*/
If ( ! Im. isnonprotectedpage (relativeurl ))
Context. response. Redirect ( " ~ /Login. aspx? Redirectpath = " + Context. Request. url. absolutepath );
}
Else
... {
/**/ /*
Retrieve the user information from the session, which is recorded in a struct named userinfo.
*/
String Role = (Userinfo) Context. session [ " Userinfo " ]). Role;
// Determine whether this role exists
If ( ! Im. isroleexist (role ))
... {
//If this role does not exist, destroy the session and ask the user to log on again.
Httpcontext. Current. session. Abandon (); httpcontext. Current. response. Redirect (configurationmanager. deleetpipeline ["Loginpage"]);
}
Else
... {
/**/ /*
When this role exists
*/
If ( ! Im. isnonprotectedpage (relativeurl ))
... {
/**/ /*
Determine whether the user has the right to access
*/
If ( ! Im. isauthorized (role, relativeurl ))
... {
//No access permission. navigate to the logon Page Context. response. Redirect (configurationmanager. deleettings ["refuseaccesspage"] + "? Redirectpath = "+ context. Request. urlreferrer );
}
}
}
}
}
}