asp.net core web页面验证

本例是用简单角色验证方式来通过用户登录后，获取用户角色，每种角色可以通过[Authorize(Roles = "admin,user")]在Action上来控制访问的权限，也就是说，只有属性这个角色才能访问这个Action。

道先添加Microsoft.AspNetCore.Authentication.Cookies引用

在StartUp.cs的Configure方法中添加

//为验证添加中间件 app.UseCookieAuthentication(new CookieAuthenticationOptions {     //验证方案名称     AuthenticationScheme = "loginvalidate",     //没有权限时导航的登录action     LoginPath = new Microsoft.AspNetCore.Http.PathString("/login"),     //访问被拒绝后的acion     AccessDeniedPath = new Microsoft.AspNetCore.Http.PathString("/Home/NoPermission"),           AutomaticAuthenticate = true,     AutomaticChallenge = true,     SlidingExpiration = true });

HomeController中的登录的action实现

using System.Collections.Generic; using System.Linq; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Authorization; using System.Security.Claims;   namespace webAuth.Controllers {     /// <summary>     /// 本Controller允许admin和user两种角色可以访问     /// </summary>     [Authorize(Roles = "admin,user")]     public class HomeController : Controller     {         public IActionResult Index()         {             return View();         }         /// <summary>         /// aobout只允许user角色访问         /// </summary>         /// <returns></returns>         [Authorize(Roles = "user")]         public IActionResult About()         {             var id = User.Claims.SingleOrDefault(c => c.Type == ClaimTypes.Sid).Value;             ViewData["Message"] = "UserID:"+ id;               return View();         }         /// <summary>         /// contact只允许admin角色访问         /// </summary>         /// <returns></returns>         [Authorize(Roles = "admin")]         public IActionResult Contact()         {             var id=User.Claims.SingleOrDefault(c => c.Type == ClaimTypes.Sid).Value;             ViewData["Message"] = "UserID:"+ id;               return View();         }           public IActionResult NoPermission()         {             return View();         }           /// <summary>         /// 允许所有登录者         /// </summary>         /// <param name="returnUrl">如果用户访问的不是登录页，returnUrl将把这个url传进来，待登录成功后返回这个地址</param>         /// <returns></returns>         [AllowAnonymous]         [HttpGet("login")]         public IActionResult Login(string returnUrl)         {             //判断是否验证             if (!HttpContext.User.Identity.IsAuthenticated)             {                 //把返回地址保存在前台的hide表单中                 ViewBag.returnUrl = returnUrl;             }             ViewBag.error = null;             return View();         }         /// <summary>         /// 允许所有登录者         /// </summary>         /// <param name="username">用户名</param>         /// <param name="password">密码</param>         /// <param name="returnUrl">返回u</param>         /// <returns></returns>         [AllowAnonymous]         [HttpPost("login")]         public IActionResult Login(string username, string password, string returnUrl)         {             //从数据库验证用户，关取出用户所需要信息             var users = new List<dynamic>() {                 new { ID = 1, UserName = "zsf",Password="111", Name = "张三丰", RoleTypeID = 1, RoleType = "admin", RoleTypeName = "管理员" },                  new { ID = 2, UserName = "zwj",Password="222", Name = "张无忌", RoleTypeID = 2, RoleType = "user", RoleTypeName = "普通用户" }             };             var user = users.SingleOrDefault(u => u.UserName == username && u.Password == password);             if (user!=null)             {                 //登录成功后，设置声明                 var claims = new Claim[] {                       new Claim(ClaimTypes.UserData,username),                       new Claim(ClaimTypes.Role,user.RoleType),                       new Claim(ClaimTypes.Name,user.Name),                       new Claim(ClaimTypes.Sid,user.ID.ToString())                 };                 HttpContext.Authentication.SignInAsync("loginvalidate", new ClaimsPrincipal(new ClaimsIdentity(claims, "Cookie")));                 HttpContext.User = new ClaimsPrincipal(new ClaimsIdentity(claims));                 return new RedirectResult(returnUrl == null ? "/" : returnUrl);             }             else             {                 ViewBag.error = "用户名或密码错误！";                 return View();             }         }     } }

Login.cshtml页面如下：

@{     Layout = null; } <!DOCTYPE html> <html> <head>     <meta charset="utf-8" />     <meta name="viewport" content="width=device-width, initial-scale=1.0" />     <title>登录</title>     <link href="~/lib/bootstrap/dist/css/bootstrap.css" rel="stylesheet" />     <style>         .col-md-12 {             text-align: center;             margin-top: 10px;         }           .input-group {             width: 300px;             margin: 0 auto;         }              .input-group-addon{             width:80px;         }      </style> </head> <body>     <form method="post" action="/login">         <div class="container">             <div class="row" >                 <div class="col-md-12">                     <div class="input-group">                         <span class="input-group-addon" id="basic-addon1">用户名</span>                         <input type="text" class="form-control" name="username" aria-describedby="basic-addon1">                     </div>                 </div>             </div>             <div class="row">                 <div class="col-md-12">                     <div class="input-group">                         <span class="input-group-addon" id="basic-addon1">密码</span>                         <input type="password" class="form-control" name="password" aria-describedby="basic-addon1">                     </div>                 </div>             </div>             <div class="row">                 <div class="col-md-12">                     <div class="input-group" >                         <input type="hidden" value="@ViewBag.returnUrl" name="returnUrl" />                         <button type="submit" class="btn btn-primary" >登录</button>                     </div>                 </div>             </div>             @if (ViewBag.error != null)             {                 <font color="red">@ViewBag.error</font>             }         </div>     </form>     <script src="~/lib/bootstrap/dist/js/bootstrap.js"></script>     <script src="~/lib/jquery/dist/jquery.js"></script> </body> </html>

如果在其他页面使用User，可以像下面这样使用

<span>当前用户：@User.Identity.Name</span>

当然也可以从User中查到其他登录时存储的Claim的值

登录成功后

登录成功后访问没有权限页面（当然可以不让这种角色看到不能访问的链接）