I am writing a MVC 4 web application with custom authentication and authorization . When a user logs in to the site, I create a FormsAuthenticationTicket and save it in a cookie
public void SignIn(string userName, bool createPersistentCookie, string UserData)
{
if (String.IsNullOrEmpty(userName)) throw new ArgumentException("Value cannot be null or empty.", "userName");
FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(1, userName, DateTime.Now, DateTime.Now.AddDays(15), createPersistentCookie, UserData);
string encTicket = FormsAuthentication.Encrypt(authTicket);
HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
HttpContext.Current.Response.Cookies.Add(faCookie);
}
The string UserData strong> will be a string with restrictions on the channels and will always contain at least two elements: UserID | The UserRole . A user can be assigned to one or more roles, so UserData may look like this: UserID | UserRole | UserRole | UserRole
Then I have my own own shared in Global.asax
protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
string cookieName = FormsAuthentication.FormsCookieName;
HttpCookie authCookie = Context.Request.Cookies[cookieName];
if (authCookie == null) return;
FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
string[] UserData = authTicket.UserData.Split(new Char[] { '|' });
GenericIdentity userIdentity = new GenericIdentity(authTicket.Name);
GenericPrincipal userPrincipal = new GenericPrincipal(userIdentity, UserData);
Context.User = userPrincipal;
}
, , , , , , .
, , , , , FormsAuthenticationTicket UserDatastrong > , , . , UserDatastrong > 1 | p > , , , , UserDatastrong > FormsAuthenticationTicket ...
, , , ?
.
.