asp.net-mvc – ASP.Net MVC中的两步认证

视图模型

public LoginForm
{
    public string UserName { get; set; }
    public string Password { get; set; }

    public int SecretQuestionId { get; set; }
    public string SecretQuestion { get; set; }
    public string SecretQuestionAnswer { get; set; }
}

行动方法

public ActionResult Login()
{
    var form = new LoginForm();
    return View(form);
}

[HttpPost]
public ActionResult Login(LoginForm form)
{
    if (form.SecretQuestionId == 0)
    {
        //This means that they've posted the first half - Username and Password
        var user = AccountRepository.GetUser(form.UserName,form.Password);
        if (user != null)
        {
            //Get a new secret question
            var secretQuestion = AccountRepository.GetRandomSecretQuestion(user.Id);
            form.SecretQuestionId = secretQuestion.Id;
            form.SecretQuestion = secretQuestion.QuestionText;
        }
    }
    else
    {
        //This means that they've posted from the second half - Secret Question
        //Re-authenticate with the hidden field values
        var user = AccountRepository.GetUser(form.UserName,form.Password);
        if (user != null)
        {
            if (AccountService.CheckSecretQuestion(form.SecretQuestionId,form.SecretQuestionAnswer))
            {
                //This means they should be authenticated and logged in
                //Do a redirect here (after logging them in)
            }
        }
    }

    return View(form);
}

视图

<form>
    @if (Model.SecretQuestionId == 0) {
        //Display input for @Model.UserName
        //Display input for @Model.Password
    }
    else {
        //Display hidden input for @Model.UserName
        //Display hidden input for @Model.Password
        //Display hidden input for @Model.SecretQuestionId
        //Display @Model.SecretQuestion as text
        //Display input for @Model.SecretQuestionAnswer
    }
</form>

如果您不满意将用户名和密码发送回隐藏字段中的视图以重新进行身份验证并确保他们不会作弊…您可以创建一个HMAC或类似的东西进行测试.

顺便说一句,这个问题看起来好像是一些问题……所以刚刚回答了如何用一种视图/动作方法进行两步验证.