ASP.NET成员资格提供程序 - 重置密码功能 - 电子邮件确认和密码更改 [英] ASP.NET Membership Provider - Reset Password Features - Email Confirmation and Password Change
问题描述
有没有人有以下功能的解决方案(样品code):
Does anyone have a solution (sample code) for the following features:
- 创建一个randomGuid /密码学
强大的随机数 - 发送包含一个唯一的URL
随机数给用户的电子邮件
地址 - 当确认时,用户被要求
更改密码
我的提供商参数化是这样的:
My provider is currently parametrized this way:
enablePasswordRetrieval="false"
enablePasswordReset="true"
requiresQuestionAndAnswer="false"
applicationName="/"
requiresUniqueEmail="true"
passwordFormat="Hashed"
maxInvalidPasswordAttempts="5"
minRequiredPasswordLength="5"
minRequiredNonalphanumericCharacters="0"
passwordAttemptWindow="10"
passwordStrengthRegularExpression=""
name="AspNetSqlMembershipProvider"
这类程序的安全问题进行了讨论<一个href=\"http://stackoverflow.com/questions/2150895/resetting-asp-net-password-security-issues\">here之前。
推荐答案
瑞,我是在一个类似于船的几个飞蛾前,并没有之前曾曝光的成员提供了很大的,我挣扎着爬它正确实施,是因为我认为你必须实现和使用整个事情是,或什么都没有。
Rui, I was in a similar boat a few moths ago, and not having had a great deal of exposure to the membership provider before, I struggled to get it implemented properly, because I thought you have to implement and use the whole thing as is, or nothing at all.
好吧,我很快就发现,你只能使用其中的一部分,而不是整个对象。例如,在我的应用我有我自己的用户对象和我自己的密码和登录模块,但我需要得到窗体身份验证工作。所以我基本上只使用该部分的会员供应商。我不覆盖任何方法或什么,只是使用它的FormsAuthentication,然后我用我自己的仓库来更改密码,验证用户名密码等。
Well I soon discovered that you can only use parts of it, not the entire object. For example in my application I have my own user object and my own password and login modules, but I needed to get forms authentication working. So I basically just use the Membership provider for that part. I am not overriding any methods or anything, just use it for FormsAuthentication, then I use my own repositories to changing passwords, verifying username passwords etc.
下面是从我的MVC登录code片段。
Here is a snippet from my login code in MVC.
var authTicket = new FormsAuthenticationTicket(1, user.UniqueName, DateTime.UtcNow, DateTime.UtcNow.AddHours(2), rememberMe, cookieValues);
var encryptedTicket = FormsAuthentication.Encrypt(authTicket);
var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket) { Expires = DateTime.UtcNow.AddDays(14) };
httpResponseBase.Cookies.Add(authCookie);
这使我使用FormsAuthentication.SignOut();方法等方法会员提供器提供了。
This enables me to use the FormsAuthentication.SignOut(); methods and other methods the membership provider makes available.
在你的问题再创建一个randomGuid /强加密随机数,这里是一个很好的方法,你可以使用,我发现它前一段时间,我很抱歉,但不记得在网络上
On your question re Create a randomGuid/Cryptographically strong random number, here is a good method you can use, I found it a while ago, and I am sorry but can't remember where on the web
/// <summary>
/// A simple class which can be used to generate "unguessable" verifier values.
/// </summary>
public class UnguessableGenerator
{
const string AllowableCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789/^()";
const string SimpleAllowableCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
/// <summary>
/// Generates an unguessable string sequence of a certain length
/// </summary>
/// <param name="length">The length.</param>
/// <param name="useSimpleCharacterSet">if set to <c>true</c> [use simple character set].</param>
/// <returns></returns>
public static string GenerateUnguessable(int length, bool useSimpleCharacterSet = false, string additionalCharacters = "")
{
var random = new Random();
var chars = new char[length];
var charsToUse = useSimpleCharacterSet ? SimpleAllowableCharacters : AllowableCharacters;
charsToUse = string.Format("{0}{1}", charsToUse, additionalCharacters);
var allowableLength = charsToUse.Length;
for (var i = 0; i < length; i++)
{
chars[i] = charsToUse[random.Next(allowableLength)];
}
return new string(chars);
}
/// <summary>
/// Generates an ungessable string, defaults the length to what google uses (24 characters)
/// </summary>
/// <returns></returns>
public static string GenerateUnguessable()
{
return GenerateUnguessable(24);
}
}
有关发送包含随机数到用户的电子邮件地址的唯一URL,你需要的是您的用户表或任何表来存储一个随机ID,然后使用一个特制的URL在电子邮件用户的方式可以用它来验证。
For Send a unique URL containing the random number to the user's email address, what you need is in your User table or any table a way to store a random id and then use that in a crafted url in an email that the user can use to verify.
这将要求您创建一个URL,将接受该类型的URL,然后你必须提取所需构成了查询字符串的部件和更新您的用户对象。
This will require you to create a Url that will accept that type of Url, and then you have to extract the parts you need form the querystring and update your user object.
有关在确认后,系统会要求用户更改密码,默认情况下在你的表强制用户更改自己的密码,一个位标志,这会派上用场后来太多,如果你需要强制用户更改密码。于是登录code查看是否此位标志时,如果是这样,它会先强制更改密码。然后,一旦用户改变了他的密码,你会变成这个标志了。
For When confirmed, the user is asked to change password, by default have a bit flag in your table that forces a user to change his password, this will come in handy later too if you need to force a user to change password. So then your login code looks to see if this bit flag is on, and if so, it will force a password change first. Then once the user has changed his password, you will turn this flag off.
希望这有助于。
这篇关于ASP.NET成员资格提供程序 - 重置密码功能 - 电子邮件确认和密码更改的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!