MVC authorization validation based on FormsAuthentication mode

1. Sign-in code

 1 [HttpPost] 2 public actionresult Index (user entity) 3 {4 User user = GetUser (entity. Name, entity. Password); 5 if (user! = null) 6 {7 FormsAuthenticationTicket AuthTicket = new Formsauthenti Cationticket (8 1, 9 user. Userid.tostring (), datetime.now,11 DateTime.Now.AddMinutes (30), 1 2 false,13 user. Rolenames.xjoin (",")); string encticket = Formsauthentication.encrypt (AuthTicket);                  Pcookie cookie = httpcontext.request.cookies[formsauthentication.formscookiename];16 if (cookie = = null) 17 {cookies = new HttpCookie (formsauthentication.formscookiename); 19} Cookies. Value = encticket;21 HttpContext.Response.AppendCookie(cookie); return redirecttoaction ("Index", "Test"),}24 return View (); 25 }

FormsAuthenticationTicket's User.RoleNames.XJoin (",") is the extension method I wrote myself, representing the string separated by ",".
Generate notes

Code in the 2.global.asax

1 protected void Application_AuthenticateRequest (Object sender, EventArgs e) 2         {3             if (HttpContext.Current.User ! = NULL) 4             {5                 if (HttpContext.Current.User.Identity.IsAuthenticated) 6                 {7                     if ( HttpContext.Current.User.Identity is formsidentity) 8                     {9                         formsidentity id = (formsidentity) Httpcontext.current.user.identity;10                         FormsAuthenticationTicket ticket = ID. Ticket;11                         String userData = Ticket. Userdata;12                         string[] roles = Userdata.split (', ');                         HttpContext.Current.User = new GenericPrincipal (ID, roles);                     }16                 }17             }18         }

To the user ticket when a string of role information is added, such as "Administrator", when a request comes over the time, ASP. NET will have a Application_AuthenticateRequest event, specifically for the user authentication authorization, In this event we only need to reconstruct the character expression to the user, and we add the following code to the Global.asax Application_AuthenticateRequest method

The code in 3.Controller

1     [Authorize (roles= "sysadmin")] 2 public     class Testcontroller:controller 3     {4 public         ActionResult Index () 5         {6             return View (); 7         } 8     }

The Roles parameter can contain more than one role, such as ([Authorize (roles= "Sysadmin,conadmin")]), and the Authorize property page can be specifically controlled to an action, You only need to write it to the property of the corresponding action method.

The code in 4.webConfig

1 <authentication mode= "Forms" >2       <forms loginurl= "~/login/index" timeout= "2880"/>3 </ Authentication>

MVC authorization validation based on FormsAuthentication mode