BR>
<configuration>
<system.web>
<authentication mode="Forms" >
<forms loginUrl = "login.ASPx" name = "FORMSAUTHCOOKIE"/>
</authentication>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</configuration>
XML文件：
<Users>
<Users>
<UserEmail>
[email protected]</UserEmail>
<UserPassWord>
BA56E5E0366D003E98EA1C7F04ABF8FCB3753889
</UserPassWord>
</Users>
<Users>
<UserEmail>
[email protected]</UserEmail>
<UserPassWord>
07B7F3EE06F278DB966BE960E7CBBD103DF30CA6
</UserPassWord>
</Users>
</Users>
login.ASPx文件：
<%@ Page LANGUAGE="c#" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.SqlClIEnt" %>
<%@ Import Namespace="System.Web.Security " %>
<%@ Import Namespace="System.IO" %>
<Html>
<head>
<title>Forms Authentication</title>
<script runat=server>
private void Login_Click(Object sender, EventArgs e)
{
if( !Page.IsValid )
{
Msg.Text = "Some required fIElds are invalid.";
return;
}
String cmd = "UserEmail='" + UserEmail.Value + "'";
DataSet ds = new DataSet();
FileStream fs = new FileStream(Server.MapPath("Users.XML"),
FileMode.Open,FileAccess.Read);
StreamReader reader = new StreamReader(fs);
ds.ReadXML(reader);
fs.Close();
DataTable users = ds.Tables[0];
DataRow[] matches = users.Select(cmd);
if( matches != null && matches.Length > 0 )
{
DataRow row = matches[0];
string hashedpwd =
FormsAuthentication.HashPassWordForStoringInConfigFile
(UserPass.Value, "SHA1");
String pass = (String)row["UserPassWord"];
if( 0 != String.Compare(pass, hashedpwd, false) )
// Tell the user if no passWord match is found. It is good
// security practice give no hints about what parts of the
// logon credentials are invalid.
Msg.Text = "Invalid Credentials: Please try again";
else
// If a passWord match is found, redirect the request
// to the originally requested resource (Default.ASPx).
FormsAuthentication.RedirectFromLoginPage
(UserEmail.Value, Persist.Checked);
}
else
{
If no name matches were found, redirect the request to the AddUser page using a Response.Redirect command.
Response.Redirect("AddUser/AddUser.ASPx");
}
}
</script>
<body>
<form runat=server>
<span style="background:#80FF80">
<h3><font face="Verdana">Login Page</font></h3></span>
<table>
<tr>
<td>e-mail:</td>
<td><input id="UserEmail" type="text" runat=server/></td>
<td><ASP:RequiredFIEldValidator
ControlToValidate="UserEmail"
Display="Static"
ErrorMessage="*"
runat="server"/>
</td>
<td><ASP:RegularExpressionValidator id="RegexValidator"
ControlToValidate="UserEmail"
ValidationExpression="^([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$"
EnableClIEntScript="false"
Display="Static"
ErrorMessage="Invalid format for e-mail address."
runat="server"/>
</td>
</tr>
<tr>
<td>PassWord:</td>
<td><input id="UserPass" type=passWord runat=server/></td>
<td><ASP:RequiredFIEldValidator
ControlToValidate="UserPass"
Display="Static"
ErrorMessage="*"
runat="server"/>
</td>
</tr>
<tr>
<td>Persistent CookIEs:</td>
<td><ASP:CheckBox id=Persist runat="server"
autopostback="true" />
</td>
<td></td>
</tr>
</table>
<input type="submit" OnServerClick="Login_Click" Value="Login"
runat="server"/><p>
<ASP:Label id="Msg" ForeColor="red" Font-Name="Verdana"
Font-Size="10" runat="server" />
</form>
</body>
</Html>
addUser.ASPx
<%@ Page LANGUAGE="c#" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.SqlClIEnt" %>
<%@ Import Namespace="System.Web.Security " %>
<%@ Import Namespace="System.IO" %>
<Html>
<head>
<title>Forms Authentication</title>
<script runat=server>
private void Page_Load(Object Src, EventArgs e)
{
String email = Request.QueryString["UserEmail"];
if( null != email )
UserEmail.Value = email;
}
private void AddUser_Click(Object sender, EventArgs e)
{
if( !Page.IsValid )
{
Msg.Text = "Some required fIElds are invalid.";
return;
}
DataSet ds = new DataSet();
String userFile = "users.XML";
FileStream fs = new FileStream(Server.MapPath(userFile),
FileMode.Open,FileAccess.Read);
StreamReader reader = new StreamReader(fs);
ds.ReadXML(reader);
fs.Close();
string hashedpwd =
FormsAuthentication.HashPassWordForStoringInConfigFile
(UserPass.Value, "SHA1");
DataRow newUser = ds.Tables[0].NewRow();
newUser["UserEmail"] = UserEmail.Value;
newUser["UserPassWord"] = hashedpwd;
ds.Tables[0].Rows.Add(newUser);
ds.AcceptChanges();
fs = new FileStream(Server.MapPath(userFile), FileMode.Create,
FileAccess.Write|FileAccess.Read);
StreamWriter writer = new StreamWriter(fs);
ds.WriteXML(writer);
writer.Close();
fs.Close();
Response.Redirect("Default.ASPx");
}
</script>
<body>
<form runat=server>
<div style="background:#ccccff">
<h3><font face="Verdana">Add New User</font></h3>
</div>
<table>
<tr>
<td>Name:</td>
<td><input id="UserEmail" type="text" runat=server/></td>
<td><ASP:RequiredFIEldValidator
ControlToValidate="UserEmail"
Display="Static"
ErrorMessage="*"
runat=server/>
</td>
<td><ASP:RegularExpressionValidator id="RegexValidator"
ControlToValidate="UserEmail"
ValidationExpression="^([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$"
EnableClIEntScript="false"
Display="Static"
ErrorMessage="Invalid format for e-mail address."
runat="server"/>
</td>
</tr>
<tr>
<td>PassWord:</td>
<td><input id="UserPass" type=passWord runat=server/></td>
<td><ASP:RequiredFIEldValidator
ControlToValidate="UserPass"
Display="Static"
ErrorMessage="*"
runat=server/>
</td>
</tr>
<tr>
<td>Persistent Forms:</td>
<td><ASP:CheckBox id=Persist runat="server"
autopostback="true" />
</td>
</tr>
</table>
<input type="submit" OnServerClick="AddUser_Click" Value="Add User"
runat="server"/><p>
<ASP:Label id="Msg" ForeColor="red" Font-Name="Verdana"
Font-Size="10" runat=server />
</form>
</body>
</Html>
Default.ASPx
<%@ Page LANGUAGE="c#" %>
<Html>
<title>Forms Authentication</title>
<script runat=server>
private void Page_Load(Object Src, EventArgs e)
{
Welcome.InnerHtml = "Hello, " +
Server.HtmlEncode(User.Identity.Name);
}
private void Signout_Click(Object sender, EventArgs e)
{
FormsAuthentication.SignOut();
Response.Write("Logged out - cookIE deleted.");
}
</script>
<body>
<h3><font face="Verdana">Forms Authentication Example</font></h3>
<span id="Welcome" runat=server/>
<form runat=server>
<input type="submit" OnServerClick="Signout_Click"
Value="Signout" runat="server"/><p>
</form>
</body>
</Html>