asp.net – 来自AJAX的表单身份验证和POST请求

在研究了这个问题并进行了一些研究之后,我发现当一个web-app受到Forms-Authentication的保护并且用户未经过身份验证时,会发生以下情况：

>如果是GET请求 – 用户是
重定向到登录页面.
>如果是对页面的POST请求 – 用户是
重定向到登录页面.
>如果是对Web服务的POST请求 –
用户获得401未授权

这就是ASP.NET的工作原理

如果一个Web服务由AJAX(xmlHttpRequest对象)调用并返回401 – 当然浏览器会显示一个弹出式登录框.

现在,您应该做的是向Application_PostAuthenticateRequest添加一些代码,以防止为webservices抛出401.

protected void Application_PostAuthenticateRequest(Object sender,EventArgs e)
{
    if (Request.RequestType == "POST" //if its POST
        && !User.Identity.IsAuthenticated //if user NOT authed
        && !HasAnonymousAccess(Context) //if it's not the login page
        )
    {
        //lets get the auth type
        Configuration config = WebConfigurationManager.OpenWebConfiguration("~");
        SystemWebSectionGroup grp = (SystemWebSectionGroup)config.GetSectionGroup("system.web");
        AuthenticationSection auth = grp.Authentication;
        //if it FORMS auth
        if(auth.Mode== AuthenticationMode.Forms)
        {

            //then redirect... this redirect won't work for AJAX cause xmlHttpRequest can't handle redirects,but anyway...
            Response.Redirect(FormsAuthentication.LoginUrl,true);
            Response.End();

        }
    }
}
public static bool HasAnonymousAccess(HttpContext context)
{
    return UrlAuthorizationModule.CheckUrlAccessForPrincipal(
        context.Request.Path,new GenericPrincipal(new GenericIdentity(string.Empty),null),context.Request.HttpMethod);
}