Authentication through web.config not authenticati

This is one of this things that should be extremely simple and I just can't work out why it's not working.

I'm trying to set up some very quick authentication for an ASP.net 3.5 app but storing the usernames and passwords in the web.config file (I know it's not very secure but it's an internal app that I keep getting asked to add and remove logins for so this is the quickest way to do it).

So, the relevant config section looks like this:

<authentication mode="Forms">
   <forms loginUrl="~/login.aspx">
    <credentials>
     <user name="user" password="password" />
     <user name="user2" password="password2" />
    </credentials>
   </forms>
  </authentication>

  <authorization>
    <deny users="?"/>
  </authorization>

And, in the login page, the code look like this:

string username = tbUsername.Text;
string password = tbPassword.Text;

if (FormsAuthentication.Authenticate(username, password))
    FormsAuthentication.RedirectFromLoginPage(username, false);

But, FormsAuthentication.Authenticate(username, password) always returns false. And I can't figure out why.

I even tried using Membership.ValidateUser but that just adds in a local database to the App_Data folder.

Is there something really basic I'm forgetting here or does this not work at all in .net 3.5?

标签： asp.net authentication web-config forms-authentication authorization

5条回答

我欲成王，谁敢阻挡

2楼-- · 2019-01-24 05:02

I'm not sure if this has changed in .NET 3.5, but the <credentials> element has an attribute passwordFormat that defines the format for passwords in the web.config. From the MSDN documentation for .NET 3.5, the default format is SHA1.

If you're using cleartext usernames and passwords in your web.config, you should use:

...
<credentials passwordFormat="Clear">
...

Event though this is an internal application I'd still recommend at least hashing the password instead of leaving it in clear text.

0人赞添加讨论(0) 举报

虎瘦雄心在

3楼-- · 2019-01-24 05:08

Another possible pitfall that is that the user name "Admin" appears to be special and not honored if your testing a credential set in web.config

<credentials>
 <user name="Admin" password="somepassword" />  //Authentication always returns false for me
</credentials>

<credentials>
 <user name="MyName" password="somepassword" />  //Authentication works normally 
</credentials>

The problem doesn't seem to apply in your case, but I just spent an hour figuring that out so I thought I'd record it here.

0人赞添加讨论(0) 举报

Fickle 薄情

4楼-- · 2019-01-24 05:09

I think the reason is because you did not indicate the passwordFormat. http://msdn.microsoft.com/en-us/library/e01fc50a.aspx

Default is SHA1, hence your clear text in fact not used properly.

0人赞添加讨论(0) 举报

唯我独甜

5楼-- · 2019-01-24 05:19

i find that solution........first you have to get hashvalue by using FormsAuthentication.HashPasswordForStoringInConfigFile("abc","SHA1") in text box by running your program and then provide this value in

0人赞添加讨论(0) 举报

家丑人穷心不美

6楼-- · 2019-01-24 05:24

You have to specify <credentials passwordFormat="Clear"> when you store password in clear text.

The alternatives are encrypted passwords using MD5 or SHA1.

See http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.hashpasswordforstoringinconfigfile.aspx for a function to encode a password.

You might also consider using some of the available user controls that does a lot for you automatically. Look under the "Login" section in the control toolbox in Visual Studio.

The following page will provide everything you need for this simple case, and the looks of the Login control is fully customizable:

<%@ Page Language="C#" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

    protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
    {
        e.Authenticated = FormsAuthentication.Authenticate(Login1.UserName, Login1.Password);
    }
</script>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title>Login</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <asp:Login ID="Login1" runat="server" onauthenticate="Login1_Authenticate">
        </asp:Login>
    </div>
    </form>
</body>
</html>

0人赞添加讨论(0) 举报

Authentication through web.config not authenticati

采纳回答

编辑标签

举报内容

检举类型

检举原因

检举说明(必填)

打开微信“扫一扫”，打开网页后点击屏幕右上角分享按钮

付费偷看金额在0.1-10元之间