ASP.NET MVC中使用Cookie存储登录用户ID的通用类实现需求

核心实现思路 #

把Cookie的读写逻辑封装成独立工具类，结合身份验证上下文确保仅登录用户可写入，读取时自动处理Cookie过期、解析等问题，实现业务代码里的复用。

通用Cookie工具类代码 #

public static class UserCookieHelper
{
    // 统一Cookie名称，避免硬编码
    private const string UserInfoCookieName = "UserInfo";

    /// <summary>
    /// 写入用户ID/名称到Cookie
    /// </summary>
    /// <param name="httpContext">当前Http上下文</param>
    /// <param name="userId">用户ID</param>
    /// <param name="userName">用户名</param>
    public static void SetUserInfo(HttpContextBase httpContext, string userId, string userName)
    {
        // 未登录直接返回
        if (httpContext == null || !httpContext.User.Identity.IsAuthenticated)
            return;

        var cookie = new HttpCookie(UserInfoCookieName)
        {
            // 用|分割存储ID和名称，也可以换成JSON序列化存复杂信息
            Value = $"{userId}|{userName}",
            // 设置过期时间，和登录态保持一致或自定义
            Expires = DateTime.Now.AddDays(7),
            // 开启HttpOnly防范XSS攻击
            HttpOnly = true,
            // 生产环境建议开启Secure，仅HTTPS传输Cookie
            // Secure = true
        };

        httpContext.Response.Cookies.Add(cookie);
    }

    /// <summary>
    /// 从Cookie读取用户信息
    /// </summary>
    /// <param name="httpContext">当前Http上下文</param>
    /// <returns>用户ID和名称的元组，未登录或Cookie无效时返回null</returns>
    public static (string UserId, string UserName)? GetUserInfo(HttpContextBase httpContext)
    {
        if (httpContext == null || !httpContext.User.Identity.IsAuthenticated)
            return null;

        var cookie = httpContext.Request.Cookies[UserInfoCookieName];
        if (cookie == null || string.IsNullOrWhiteSpace(cookie.Value))
            return null;

        var userParts = cookie.Value.Split('|');
        if (userParts.Length != 2)
            return null;

        return (userParts[0], userParts[1]);
    }

    /// <summary>
    /// 清除用户信息Cookie
    /// </summary>
    /// <param name="httpContext">当前Http上下文</param>
    public static void ClearUserInfo(HttpContextBase httpContext)
    {
        if (httpContext == null)
            return;

        var cookie = httpContext.Request.Cookies[UserInfoCookieName];
        if (cookie != null)
        {
            cookie.Expires = DateTime.Now.AddDays(-1);
            httpContext.Response.Cookies.Add(cookie);
        }
    }
}

业务场景中的使用示例 #

1. 登录成功时写入Cookie #

在登录Action里完成验证后调用：

[HttpPost]
public ActionResult Login(LoginViewModel model)
{
    if (ModelState.IsValid && ValidateUserCredentials(model.UserName, model.Password))
    {
        FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
        // 从数据库获取用户ID
        var userId = GetUserIdFromDb(model.UserName);
        // 写入Cookie
        UserCookieHelper.SetUserInfo(HttpContext, userId, model.UserName);
        return RedirectToAction("Index", "Home");
    }
    return View(model);
}

2. 新增/修改内容时读取Cookie #

在创建或编辑的业务Action里直接调用：

[HttpPost]
public ActionResult Create(ContentViewModel model)
{
    if (ModelState.IsValid)
    {
        var userInfo = UserCookieHelper.GetUserInfo(HttpContext);
        if (userInfo.HasValue)
        {
            model.CreatedBy = userInfo.Value.UserName;
            model.CreatorId = userInfo.Value.UserId;
            // 修改场景同理，可设置ModifiedBy/ModifierId
        }
        db.Contents.Add(model);
        db.SaveChanges();
        return RedirectToAction("Index");
    }
    return View(model);
}

3. 登出时清除Cookie #

public ActionResult Logout()
{
    FormsAuthentication.SignOut();
    UserCookieHelper.ClearUserInfo(HttpContext);
    return RedirectToAction("Login");
}

额外优化建议 #

• 如果需要存储更多用户字段，建议用JSON序列化（比如Newtonsoft.Json）替代字符串分割，避免解析错误。
• 可以封装ActionFilterAttribute，在Action执行前自动把用户信息注入到Model，进一步减少重复代码。

内容的提问来源于stack exchange，提问作者Aahana Dutta