ASP.NET MVC 5 - 如何让用户保持登录状态

Question

I am creating website where people can register and log in. I am using a SQL Server database with Entity Framework.

Here is my Action for login in

[HttpPost]
public ActionResult LoggingIn(User user)
{
    ModelState.Clear();
    var result = MainLogic.LogIn(user);
    if (result.MessegeID == 0)
    {
        RedirectToAction("Index");
    }
    else
        ViewBag.LoginInfo = result.Msg;

    return View("Index");
}

Now I want the logged in user to be logged in for x time. I`ve been trying to do it with TempData[LoggedAs] = user and every time the user switches view I had TempData.Keep() until the user sign out.

I don't think its good practice, how else I can hold the user?

Answer 1

You need to set a session variable when login is successful. Then you check if that session variable is set, if not, you send them to your login page. This might help you https://codereview.stackexchange.com/questions/51331/simple-authentication-in-asp-net-mvc-5

This is the very basic idea and hope this made some sense for you.

Answer 2

I Think it's not a good idea to use your own authentication system since you haven't a lot of knowledge in this staff, I recommend Identity to manage users authentication, there are two points to consider when persisting user login :

1. Set the expire time for cookies

In the ConfigureAuth method of Startup class, set the expire time for cookies :

 public void ConfigureAuth(IAppBuilder app)
    {
     app.UseCookieAuthentication(new CookieAuthenticationOptions
         {
             AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
             LoginPath = new PathString("/Account/Login"),
             ExpireTimeSpan = new System.TimeSpan(90, 0, 0, 0),
             CookieHttpOnly = false,
             SlidingExpiration = true,
          });
     }

1. Set the machine key in IIS, more details here

Answer 3

Use sessions and cookies. As far as I know session time out is 20 min if you don't explicitly mention it. Cookies can have more timeout period than session. So my best bet is to use cookies in your app and pay attention in security and best practices also.

Answer 4

You can also use cookies to manage logging. create a cookie

HttpCookie cookie = new HttpCookie("Cookie");

Inital its value, you can store user ID or any unique data of user who have logged in.

cookie.Value = "user data";
cookie.Expires = DateTime.Now.AddSeconds(10);//You can set expire in seconds, hours or days etc. as per your choice. Cookie will get expire as per the time you have set.

Set in reponse to add cookie.

 this.ControllerContext.HttpContext.Response.Cookies.Add(cookie);

To access cookie Check the cookie if exists

if (Request.Cookies["Cookie"] != null) { 


}else{

string temp = Request.Cookies["Cookie"].Value; // access the value of cookie

}