Question

我正在努力解决这个“愚蠢”的问题。我试着看看用户是否在我的操作中进行了身份验证。我习惯做HttpContext.User.Identity.IsAuthenticated，但它总是返回false。我查看AuthorizeAttribute的代码，然后使用

protected virtual bool AuthorizeCore(HttpContextBase httpContext)
        {
            //removed code...

            IPrincipal user = httpContext.User;
            if (!user.Identity.IsAuthenticated)
            {
                return false;
            }

            //removed code....
        }

所以我的问题和困惑是为什么这不会在我的行动中起作用？

我使用Simplemembership，这是我在web.config

中使用的设置

<roleManager enabled="true" defaultProvider="SimpleRoleProvider">
              <providers>
                <clear />
                <add name="SimpleRoleProvider" 
                type="WebMatrix.WebData.SimpleRoleProvider, 
                WebMatrix.WebData" />
              </providers>
            </roleManager>
            <membership defaultProvider="SimpleMembershipProvider">
              <providers>
                <clear />
                <add name="SimpleMembershipProvider" 
                type="WebMatrix.WebData.SimpleMembershipProvider, 
                WebMatrix.WebData" />
              </providers>
            </membership>

我在模板mvc4中使用默认登录

        [HttpPost]
        [AllowAnonymous]
        [ValidateAntiForgeryToken]
        public ActionResult Login(LoginModel model, string returnUrl)
        {
            if (ModelState.IsValid && WebSecurity.Login(model.UserName, model.Password, persistCookie: model.RememberMe))
            {                
                return RedirectToLocal(returnUrl);
            }

            // If we got this far, something failed, redisplay form
            ModelState.AddModelError("", "The user name or password provided is incorrect.");
            return View(model);
        }

我在我的授权属性中使用它并且它有效，所以我的问题是什么区别？

protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
        {
            //code here....

            if (httpContext.User.Identity.IsAuthenticated)
                return true;

            return true;
        }

这就是我在行动中使用的

public ActionResult Index()
        {
            //removed code....

            if (HttpContext.User.Identity.IsAuthenticated)
            {
                return View();
            }

            // revmoved code...

            return View();
        }

Answer 1

我通常使用Application_PostAuthenticateRequest这不是过滤器。请随意忽略我的CustomPrincipal，您不必这样做。只需从我的一个项目中快速粘贴即可。

我没有看到FormsAuthentication的代码如此难以说明为什么HttpContext.User没有正确设置。请发布您的FormsAuthentication代码。

 protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
        HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
        if (authCookie != null)
        {
            FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
            var serializeModel = (CustomPrincipalSerializeModel)
                                 JsonSerializer.DeserializeFromString(authTicket.UserData,
                                                                      typeof (CustomPrincipalSerializeModel));

            var roles = serializeModel.Roles ?? new string[0];
            var newUser = new CustomPrincipal(authTicket.Name, roles)
                {
                    UserId = serializeModel.UserId,
                    UserName = serializeModel.UserName,
                    FirstName = serializeModel.FirstName,
                    LastName = serializeModel.LastName
                };
            HttpContext.Current.User = newUser;

        }
    }

为什么User.Identity.IsAuthenticated总是假的？

1 个答案: