I recently read the "ASP.NET Security Advanced Programming", which involved Forms-based verification, found that they have a lot of misunderstandings, so they decided to "ASP.NET's form-based verification to implement online security access, management" And corrections.
The file directory is:
Bin admin-index.aspx - test.aspx - * .Asspx - web.config // admin on the web.config login.aspx web.config // root directory under the web.config // Admin File
(-) Take a look at the important way for FormSauthentication and attributes (more Search MSDN)
FormScookiename Returns the configured cookie name for the current application. GetAuthCookie creates authentication cookies for a given username. This will not set the cookie to a part of the response, so the application has more control permissions on how the cookie is emitted. Authenticate gives the credentials provided, attempts to verify the credentials based on the credentials included in the configured credential storage area. GetirectURL returns a redirect URL that causes the original request to redirect to the login page. HashPasswordforstoringInfigfile gives a password and string that identifies the hash type, which generates a hash secret code that is suitable for stored in the configuration file. RedirectFromLoginPage redirects the user of the verified identity back to the original request URL. {========= Remarks the RedirectFromLoginPage method to redirect to the returned URL key specified in the query string. For example, in URL http://www.contoso.com/login.aspx?returnURL =caller.aspx, Caller.aspx is the Return URL redirected to RedirectFromLoginPage. If the return button does not exist, RedirectFromLogInPage will redirect to Default.aspx. =========} SetAuthCookie Create a collection of authentication tickets and attach it to the Cookie's outgoing response. It does not perform redirection. Signout removes the authentication ticket.
(2) Let's completely understand how the page is verified step by step.
Once again, our verification is: Admin folder is an administrator for the "zone" of the background management. Only after logging in to log in with login.aspx, you can access all pages in the Admin folder, all, we must fill in Login.aspx The form is to verify that the user is an administrator.
