以最佳做法登录？

Question

我正在开发一个管理员用户可以在系统中以其他用户类型登录的网站。我在那里需要跟踪当前的“显示”用户和当前的“登录”用户。最明显的地方似乎是会话，但你有挑战保持会话超时与认证超时同步。

见我的问题在这里： MVC session expiring but not authentication

什么是处理这类场景的最佳做法？

Answer 1

除了为超时/安全通常的web.config设置：

<location path="Portal/Dashboard"> 
<system.web> 
    <authorization> 
    <deny users="?" /> 
    </authorization> 
</system.web> 
</location> 

<authentication mode="Forms"> 
    <forms loginUrl="~/Portal/Logout" timeout="10" /> 
</authentication> 

以下是我在我的控制器处理这个问题：

 loggedInPlayer = (Player)Session["currentPlayer"]; 
     if (loggedInPlayer == null) 
     { 
      loggedInPlayer = Common.readCookieData(User.Identity); 
     } 
     if (loggedInPlayer.UserID > 0) 
     { 
      //Dude's signed in, do work here 
     } 
    else 
     { 
      return PartialView("Logout"); 
     } 

然后我退出（）控制器方法我说：

public ActionResult Logout() 
    { 
     Session["currentPlayer"] = null; 
     FormsAuthentication.SignOut(); 
     return RedirectToAction("Index", "Home", new { l = "1"}); //Your login page 
    } 

对于加工饼干，我有：

public static Player readCookieData(System.Security.Principal.IIdentity x) 
    { 
     Player loggedInPlayer = new Player(); 
     if (x.IsAuthenticated) 
     { 
      loggedInPlayer.UserID = 0; 
      if (x is FormsIdentity) 
      { 
       FormsIdentity identity = (FormsIdentity)x; 
       FormsAuthenticationTicket ticket = identity.Ticket; 
       string[] ticketData = ticket.UserData.Split('|'); 
       loggedInPlayer.UserID = Convert.ToInt32(ticketData[0]); 
       loggedInPlayer.UserFName = ticketData[1]; 
       loggedInPlayer.UserLName = ticketData[2]; 
      } 
     } 
     else 
     { 
      loggedInPlayer.UserID = 0; 
      loggedInPlayer.UserFName = "?"; 
      loggedInPlayer.UserLName = "?"; 
     } 
     return loggedInPlayer; 
    }