<configuration>             <system.web>                 <!--设置Forms身份验证-->                 <authentication mode="Forms">                     <forms loginUrl="Login.aspx" name="MyWebApp.APSXAUTH" path="/" protection="All" timeout="30"/>                 </authentication>                 <authorization>                     <allow users="*"/>                 </authorization>             </system.web>         </configuration>         <!--设置Admin目录的访问权限-->         <location path="Admin">             <system.web>                 <authorization>                     <allow roles="Admin"/>                     <deny users="?"/>                 </authorization>             </system.web>         </location>         <!--设置Users目录的访问权限-->         <location path="Users">             <system.web>                 <authorization>                     <allow roles="User"/>                     <deny users="?"/>                 </authorization>             </system.web>         </location>

        protected void btnLogin_Click(object sender, EventArgs e)         {                 //Forms身份验证初始化             FormsAuthentication.Initialize();             //验证用户输入并得到登录用户，txtName是用户名称，txtPassword是登录密码             UserModel um = ValidUser(txtName.Text.Trim(),txtPassword.Text.Trim());             if (um != null)             {              //创建身份验证票据              FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,                                             um.Name,                                             DateTime.Now,                                             DateTime.Now.AddMinutes(30),                                             true,                                             um.Roles,//用户所属的角色字符串                                             FormsAuthentication.FormsCookiePath);              //加密身份验证票据              string hash = FormsAuthentication.Encrypt(ticket);              //创建要发送到客户端的cookie              HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hash);              if (ticket.IsPersistent)              {                 cookie.Expires = ticket.Expiration;              }              //把准备好的cookie加入到响应流中              Response.Cookies.Add(cookie);              //转发到请求的页面              Response.Redirect(FormsAuthentication.GetRedirectUrl(um.Name,false));             }             else             {              ClientScriptManager csm = this.Page.ClientScript;              csm.RegisterStartupScript(this.GetType(), "error_tip", "alert('用户名或密码错误！身份验证失败！');", true);             }         }             //验证用户         private UserModel ValidUser(string name, string password)         {             return new UserService().Validate(name, password);         }

        //改造原来的User，给其添加一个用户所属的角色数据         protected void Application_AuthenticateRequest(object sender, EventArgs e)         {             if (HttpContext.Current.User != null )             {                 if (HttpContext.Current.User.Identity.IsAuthenticated)                 {                     if (HttpContext.Current.User.Identity is FormsIdentity)                     {                         FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;                         FormsAuthenticationTicket ticket = id.Ticket;                         string userData = ticket.UserData;                         string[] roles = userData.Split(',');                         //重建HttpContext.Current.User，加入用户拥有的角色数组                         HttpContext.Current.User = new GenericPrincipal(id, roles);                     }                 }             }         }

        protected void Page_Load(object sender, EventArgs e)         {             //判断通过身份验证的用户是否有权限访问本页面             FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;             //判断通过身份验证的用户是否是Admin角色             if (!id.Ticket.UserData.Contains("Admin"))             {                 //跳转到访问权限不够的错误提示页面                 Response.Redirect("~/Error/AccessError.htm", true);             }         }         //安全退出按钮的代码         protected void btnExit_Click(object sender, EventArgs e)         {             //注销票据             FormsAuthentication.SignOut();             ClientScriptManager csm = this.Page.ClientScript;             csm.RegisterStartupScript(this.GetType(), "exit_tip", "alert('您已经安全退出了！');", true);         }

        protected void Page_Load(object sender, EventArgs e)         {             //判断通过身份验证的用户是否有权限访问本页面             FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;             //判断通过身份验证的用户是否是User角色             if (!id.Ticket.UserData.Contains("User"))             {                 //跳转到访问权限不够的错误提示页面                 Response.Redirect("~/Error/AccessError.htm", true);             }         }         //安全退出按钮的代码         protected void btnExit_Click(object sender, EventArgs e)         {             //注销票据             FormsAuthentication.SignOut();             ClientScriptManager csm = this.Page.ClientScript;             csm.RegisterStartupScript(this.GetType(), "exit_tip", "alert('您已经安全退出了！');", true);         }