MVC4-通过http POST和FormsAuthentication进行Android身份验证

Question

I know there are plenty of resources like this on the web, and the closest I've come was the answer to this question: ASP.NET Web API Authentication .

Basically, this is my requirement. Log in via android to my account on an MVC4 internet application I created (which uses SimpleMembership). It is NOT an MVC Web Api app, which seems to confuse things when looking at the various ways of achieving this.

I am attempting to use FormsAuthentication to set an authentication cookie, but I have no idea how to configure my android httpclient to actually send through this authentication cookie, or how to get MVC to save a session from my android app.

So far, this is what I've come up with on the MVC side:

    [HttpPost]
    [AllowAnonymous]
    public bool LoginMobi(LoginModel model)
    {    
        var membership = (SimpleMembershipProvider)Membership.Provider;
        if (membership.ValidateUser(model.UserName, model.Password))
        {
            FormsAuthentication.SetAuthCookie(model.UserName, false);            
            return true;
        }
        else return false;
    }

And I use the following java in my android app (sent over an SSL connection):

            DefaultHttpClient httpclient = new DefaultHttpClient();

            HttpPost httppost = new HttpPost("https://mysite/api/login");
            List<NameValuePair> nameValue = new ArrayList<NameValuePair>();
            nameValue.add(new BasicNameValuePair("UserName", "foo"));
            nameValue.add(new BasicNameValuePair("Password", "bar"));
            httppost.setEntity(new UrlEncodedFormEntity(nameValue));
            httppost.setHeader("Content-type", "application/json");
            HttpResponse response = httpclient.execute(httppost);
            // etc etc

What I haven't figured out is how to receive the authentication cookie on android and send it back with each request to controllers with the [Authorize] attribute. I'm rather new to this so please forgive my ignorance!

Answer 1

You are using FormsAuthentication which uses cookie to identify user for each request. You have two options here.

1. Use CookieStore for HttpClient. Check Android HttpClient and Cookies

   OR

2. Combine BASIC auth and FormsAuthentication. Check Combining Forms Authentication and Basic Authentication

Hope this helps.