Question

我正在构建一个具有登录页面的站点，并希望在5次尝试失败20分钟后阻止用户登录也许这是一种方式

const int maxTryCount = 5;
const int minutesToSuspend = 20;

[HttpPost]
    public ActionResult Index(PeopleAccount account, string returnUrl)
    {
        if (Session["TimeStamp"] == null || ((DateTime)Session["TimeStamp"]).AddMinutes(minutesToSuspend) <= DateTime.Now)
        {
            PeopleAccountService service = new PeopleAccountService();
            DataSet ds = service.Authentication(account.UserName, account.Password, null, null);

            if (ds.Tables[1].Rows.Count > 0)
            {
                FormsAuthentication.SetAuthCookie(account.UserName, false);
                Session.Clear();
                Session["UserAccressibility"] = ds.Tables[0];
                Session["UserFullName"] = ds.Tables[1].Rows[0][0];

                if (returnUrl != null && returnUrl.Length > 1 && returnUrl.StartsWith("/") && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
                    return Redirect(returnUrl);
                return RedirectToAction("Index", "Stuff", null);
            }
            else
            {
                Session["TryCount"] = (Session["TryCount"] == null
                                       || (Session["TimeStamp"] != null && ((DateTime)Session["TimeStamp"]).AddMinutes(minutesToSuspend) <= DateTime.Now)) ?
                                        1 : ((int)Session["TryCount"]) + 1;

                if ((int)Session["TryCount"] > maxTryCount)
                {
                    Session["TimeStamp"] = DateTime.Now;
                    return Redirect("~/UnauthorizedAccess/Index");
                }

                ModelState.AddModelError("", Paymankaran.Content.Messages.InvalidUsernameAndOrPassword);
                ModelState.AddModelError("", string.Format(Paymankaran.Content.Messages.TryCountWarning,
                                                            Session["TryCount"], maxTryCount, minutesToSuspend));
                return View();
            }
        }

        return Redirect("~/UnauthorizedAccess/Index");
    }
}

实际上我使用Session [“TimeStamp”]和Session [“TryCount”]变量来实现这个功能有更好或更安全的方式吗？这是实现此功能的好方法吗？

Answer 1

使用Asp.net membership provider可以免费为您提供此功能（以及更多内容）。

会话值超时

1 个答案: