0

我创建了一个 Web 应用程序，我希望用户在其中注册登录、注销等。

现在，我创建了一个自定义的 CreateUserWizard，它指导用户完成注册过程。

我的 web 应用程序包含几个 aspx 页面，如 Login、Register、、Services 和 Default。

当用户访问该站点时，他会看到 Default.aspx 页面，在那里他会看到一个带有三个链接的水平导航栏：主页（再次转到 Default.aspx）、服务（转到 Services.aspx 页面，其中用户看到他的服务）和将用户带到登录页面的登录链接（ASP 登录控件）。

用户第一次访问该页面时看到的 Default.aspx 页面的内容又是一个注册表单。

现在，我可以成功注册一个新用户，他的凭据存储在会员数据库中，我也可以登录一个注册用户。

用户成功登录后，将被定向到 Services.aspx 页面。

问题是当他登录后进入Services.aspx页面，点击水平导航栏中的链接时，用户会自动退出。

在身份验证标签中的 Web.config 文件中，在表单部分中，我已将其设置为不使用 cookie，而是使用cookies="UseUri"。

我这样做是因为如果我使用 cookie，当用户登录时，LoggedinView 控件不会显示 LoggedinTemplate，即登录用户的名称，并继续显示 AnonymousTemplate 的消息。

我不明白为什么会发生这种情况，但我猜它必须与不使用 cookie 的事实有关。任何人都知道可能是什么问题？

下面我提供了注册向导所在的 Default.aspx 页面的代码以及 Web.config 文件。

**请指点我正确的方向或我在这里做错了什么。

默认.aspx：

<%@ Page Title="" Language="vb" AutoEventWireup="false"


   MasterPageFile="~/GDesk.Master"
        CodeBehind="Default.aspx.vb" Inherits="GDesk._Default" %>

        <asp:Content ID="Content1" ContentPlaceHolderID="head" runat="server">
            <link rel="stylesheet" type="text/css" href="/Styles/styles.css" />
        </asp:Content>
        <asp:Content ID="Content2" ContentPlaceHolderID="MainContent" runat="server">
        <h2>
            Welcome </h2>
        <div id="SignUpForm">
            <h2 class="defaultH2">
                Sing Up</h2>
            <p class="info">
                Here you can register. If you already have an account, please log in
    <asp:HyperLink ID="defaultLogin" runat="server"       NavigateUrl="/Account/Login.aspx"
                    Text="here." />
                <span class="important">Passwords are required to be in minimum of
                    <%=Membership.MinRequiredPasswordLength()%>
                    characters.</span>
            </p>
            <span class="failureNotification">
                <asp:Literal ID="errorMessage" runat="server"></asp:Literal>
            </span>
            <p>
    <asp:ValidationSummary ID="ErrorSummary" runat="server" 
               ShowSummary="true"   CssClass="failureNotification"
               ValidationGroup="RegisterMessages" />
    <asp:ValidationSummary ID="CheckErrors" runat="server" 
               ShowSummary="true" CssClass="failureNotification"
               ValidationGroup="CheckExistence" />
    <asp:CreateUserWizard ID="RegisterUser" 
             runat="server" ContinueDestinationPageUrl="Services.aspx"  
             AutoGeneratePassword="false" 
               EnableViewState="true" MailDefinition-BodyFileName="~/MailFile.txt"
                    MailDefinition-From="psf89@yahoo.com" LoginCreatedUser="true">
       <WizardSteps>

          <asp:CreateUserWizardStep ID="CreateUser" runat="server"   
           EnableViewState="true">
               <ContentTemplate>
                  <fieldset class="register">
                    <legend>Account Information</legend>
                      <p>
                        <asp:Label ID="UserNameLabel" runat="server" 
                        Text="Username:" AssociatedControlID="UserName" />
                        <asp:TextBox ID="UserName" runat="server" 
                        CausesValidation="true" CssClass="userEntry"
                        ViewStateMode="Enabled" />
                        <asp:RequiredFieldValidator ID="UserNameRequired" 
                         runat="server" ControlToValidate="UserName"
                        ErrorMessage="Username required" 
                        CssClass="failureNotification" ToolTip="UserName is required"
                        Display="Dynamic" SetFocusOnError="true"        
                        ValidationGroup="RegisterMessages">*
                        </asp:RequiredFieldValidator>
                     </p>
                     <p>
                       <asp:Label ID="EmailLabel" runat="server"    Text="Email:" 
                        AssociatedControlID="Email" />
                       <asp:TextBox ID="Email" runat="server" CausesValidation="true" 
                       CssClass="userEntry" ViewStateMode="Enabled" />
                       <asp:RequiredFieldValidator ID="EmailRequired" runat="server" 
                       ControlToValidate="Email" ErrorMessage="Email Required"  
                       CssClass="failureNotification" ToolTip="Email is required"
                       Display="Dynamic" SetFocusOnError="true"  
                       ValidationGroup="RegisterMessages">*  
                       </asp:RequiredFieldValidator>
                       <asp:RegularExpressionValidator ID="EmailTypeRequired" 
                       runat="server" ControlToValidate="Email"
                       SetFocusOnError="true" ValidationExpression="\w+([-+.']\w+)*@\w+
                       ([-.]\w+)*\.\w+([-.]\w+)*"
                       ValidationGroup="RegisterMessages" Display="Dynamic" 
                        CssClass="failureNotification" ErrorMessage="Give a valid 
                        email" ToolTip="Give a valid email form">*
                        </asp:RegularExpressionValidator>
                    </p>
                                    <p>
                        <asp:Label ID="PasswordLabel" runat="server" 
                        Text="Password:" AssociatedControlID="Password" />
                        <asp:TextBox ID="Password" runat="server"       
                        CausesValidation="true" CssClass="userEntry"  
                         TextMode="Password" />
                       <asp:RequiredFieldValidator ID="PasswordRequired" 
                        ControlToValidate="Password" ErrorMessage="Password Required"
                        runat="server" CssClass="failureNotification" ToolTip="Password 
                        is required" Display="Dynamic" SetFocusOnError="true"    
                       ValidationGroup="RegisterMessages">* 
                       </asp:RequiredFieldValidator>
                    </p>
                    <p>
                                        <asp:Label ID="confirmPasswordLabel" 
runat="server" Text="Confirm Password:" AssociatedControlID="ConfirmPassword" />
                                        <asp:TextBox ID="ConfirmPassword" 
runat="server" CausesValidation="true" CssClass="userEntry"
                                                TextMode="Password" />
                                            <asp:RequiredFieldValidator 
ID="ConfirmPasswordRequired" runat="server" ControlToValidate="ConfirmPassword"
                                                ErrorMessage="Confirm Password  
required" 
CssClass="failureNotification" ToolTip="Confirm password is required"
                                            Display="Dynamic" SetFocusOnError="true" 
ValidationGroup="RegisterMessages">*</asp:RequiredFieldValidator>
                                            <asp:CompareValidator ID="ComparePasswords" 
runat="server" ControlToCompare="Password"
                                                ControlToValidate="ConfirmPassword" 
CssClass="failureNotification" ErrorMessage="Password and Confirmation Password must 
match"
                                                Display="Dynamic" Text="*" 
ValidationGroup="RegisterMessages">*</asp:CompareValidator>
                                    </p>
                                    <p>
                                        <asp:Label ID="SecurityQuestionLabel" 
runat="server" Text="Security Question:" AssociatedControlID="Question" />
<asp:DropDownList ID="Question" runat="server" CssClass="userEntry" 
 CausesValidation="true">
                                                <asp:ListItem Text="--Select one--" 
Value="" />
                                                <asp:ListItem>What is your mother's 
birthday ?</asp:ListItem>
                                                <asp:ListItem>What was your first dog's 
name ?</asp:ListItem>
                                                <asp:ListItem>What was your favorite 
teacher's name ?</asp:ListItem>
                                                <asp:ListItem>What is your favorite 
 actor's 
name ?</asp:ListItem>
                                        </asp:DropDownList>
                                        <br />
                                        <i>In case you forget your password you will be 
asked to answer one of the security
                                                questions you choose here and prompted 
to 
enter the answer you specify below.</i>
                                            <asp:RequiredFieldValidator 
ID="SecurityQuestionRequired" runat="server" ControlToValidate="Question"
                                                ErrorMessage="Please select a security 
question" Display="Dynamic" CssClass="failureNotification"
                                                ToolTip="You must select a security 
question in case you forget your password"
                                                SetFocusOnError="true" 
ValidationGroup="RegisterMessages">*</asp:RequiredFieldValidator>
</p>
<p>
                                        <asp:Label ID="SecurityAnswer" runat="server" 
AssociatedControlID="Answer" Text="Security Answer:" />
                                            <asp:TextBox ID="Answer" runat="server" 
CausesValidation="true" CssClass="userEntry" />
                                            <asp:RequiredFieldValidator 
ID="SecurityAnswerRequired" runat="server" ControlToValidate="Answer"
ErrorMessage="Please provite an answer to  the above question" Display="Dynamic"
ToolTip="This is the answer to the question 
you selected above" CssClass="failureNotification"
SetFocusOnError="true" 
ValidationGroup="RegisterMessages">*</asp:RequiredFieldValidator>
      </p>
   </fieldset>
</ContentTemplate>
<CustomNavigationTemplate>
                                <p class="ButtonSubmit">
                                    <asp:Button ID="Previous" runat="server" 
Text="Previous" CommandName="MovePrevious" />
                                        <asp:Button ID="CreateUserButton" 
 runat="server" 
Text="Create User" ValidationGroup="RegisterMessages"
                                            CommandName="MoveNext" />
                                    </p>
                                </CustomNavigationTemplate>
                            </asp:CreateUserWizardStep>
                            <asp:CompleteWizardStep ID="CompleteRegistration" 
runat="server">
                                <ContentTemplate>
                                    <span class="UserCreatedNotification">
                                        <asp:Literal ID="SuccessMessage" runat="server" 
Text="User Registered Succesfully !" />
                                </span>
                            </ContentTemplate>
                            <CustomNavigationTemplate>
                                <p class="ButtonCompletedReg">
                                    <asp:Button ID="Continue" runat="server" 
 Text="Continue" CommandName="Continue" />
                                </p>
                            </CustomNavigationTemplate>
                        </asp:CompleteWizardStep>
                    </WizardSteps>
                </asp:CreateUserWizard>
        </div>
        <div id="VideoPresentation">
            <h2 class="defaultH2">
                Presentation Videoh3</h2>
            <h3>
                Under Constraction...</h3>
        </div>
    </asp:Content>

这是 Web.config 文件：

<?xml version="1.0"?>

<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->

<configuration>

  <connectionStrings>
    <clear/>
    <add name="MyLocalSqlServer" connectionString="Data 
    Source=THESAINT\SQLEXPRESS;Initial Catalog=UserAuthentication;Integrated  
    Security=SSPI;"/>
  </connectionStrings>

    <system.web>
        <compilation debug="true" strict="false" explicit="true" targetFramework="4.0" 
        />

        <authentication mode="Forms">
          <forms loginUrl="/Account/Login.aspx" name=".ASPXFORMSAUTH" protection="All" 
            timeout="30" path="/FormsAuth" requireSSL="false" slidingExpiration="true" 
       defaultUrl="Default.aspx" cookieless="UseCookies" 
       enableCrossAppRedirects="false" />
        </authentication>

        <membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15">
          <providers>
            <clear/>
            <add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider" 
connectionStringName="MyLocalSqlServer" applicationName="GDesk" 
enablePasswordRetrieval="false"
                    enablePasswordReset="true" requiresQuestionAndAnswer="true" 
requiresUniqueEmail="true" passwordFormat="Hashed" maxInvalidPasswordAttempts="5"
                    minRequiredPasswordLength="6" 
 minRequiredNonalphanumericCharacters="0" 
passwordAttemptWindow="10" />
          </providers>
        </membership>

        <authorization>
          <allow users="*"/>
          <deny users="?"/>
        </authorization>   
    </system.web>

  <location path="Services.aspx" >
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>     
    </system.web>
  </location>

</configuration>

先感谢您 ！！！

4

1 回答 1

0

  1. 不要使用无饼干！！！这是非常不安全的。

  2. 如果您确实使用 cookieless，请使用相对 URL 在站点内导航。您的用户可能会被注销，因为指向 Services.aspx 的链接使用了当然不包含会话 ID 的绝对 URL。

  3. 如果您在使用 cookie 时遇到问题，可能是因为您的登录表单不在网站的根目录中。在这种情况下，cookie 将设置一个路径，使 cookie 对不在同一文件夹中的站点部分不可见。要解决此问题，请移动登录表单或将表单身份验证 cookie 的路径显式设置为“/”

于 2013-10-16T01:16:38.020 回答