ASP.NET MVC应用中基于ASMX服务的用户登录实现技术咨询

Hey there! Since you're building an integrated ASP.NET MVC 5 frontend and ASMX SOAP service (with the SOAP requirement non-negotiable), let's walk through practical steps to add user login functionality that works seamlessly between both parts, using your existing SQL Server database.

1. Reuse a Shared User Identity System #

First, align your MVC app and SOAP service to use the same user data store. You have two solid options here:

• ASP.NET Membership Provider: If you're already using this for your MVC app, it's straightforward to hook it into your ASMX service. It handles password hashing, user roles, and basic auth out of the box.
• Custom User Table: If you prefer full control, create a Users table in your SQL Server DB with fields like UserId, Username, HashedPassword, Email, and IsActive. Make sure both your MVC app and SOAP service reference this table.

2. Implement Login Logic in the ASMX Service #

Add a WebMethod to your ASMX service that handles user authentication. Here's a simple example using a custom user table (adjust based on your setup):

[WebService(Namespace = "http://your-service-namespace/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
[System.ComponentModel.ToolboxItem(false)]
public class YourSoapService : System.Web.Services.WebService
{
    [WebMethod]
    public bool ValidateUser(string username, string password)
    {
        // Connect to your SQL Server DB (use Entity Framework or ADO.NET)
        using (var db = new YourDbContext())
        {
            var user = db.Users.FirstOrDefault(u => u.Username == username && u.IsActive);
            if (user == null) return false;
            
            // Verify the hashed password (use the same hashing method as your MVC app, e.g., BCrypt)
            return BCrypt.Net.BCrypt.Verify(password, user.HashedPassword);
        }
    }

    // Optional: Return a session token or user details after successful login
    [WebMethod]
    public UserSession Login(string username, string password)
    {
        if (!ValidateUser(username, password)) return null;
        
        // Generate a unique session token (store this in your DB tied to the user)
        var sessionToken = Guid.NewGuid().ToString();
        var user = db.Users.First(u => u.Username == username);
        
        db.UserSessions.Add(new UserSession { UserId = user.UserId, Token = sessionToken, ExpiresAt = DateTime.UtcNow.AddHours(2) });
        db.SaveChanges();
        
        return new UserSession { Token = sessionToken, Username = username };
    }
}

// Helper class for session data
public class UserSession
{
    public string Token { get; set; }
    public string Username { get; set; }
    public DateTime ExpiresAt { get; set; }
}

3. Secure Subsequent SOAP Requests #

Once a user logs in (via the Login method), require them to send the session token with every subsequent request. Add a validation check at the start of each protected WebMethod:

private bool IsValidSession(string sessionToken)
{
    using (var db = new YourDbContext())
    {
        var session = db.UserSessions.FirstOrDefault(s => s.Token == sessionToken && s.ExpiresAt > DateTime.UtcNow);
        return session != null;
    }
}

[WebMethod]
public List<ConfiguredItem> GetUserConfiguredItems(string sessionToken)
{
    if (!IsValidSession(sessionToken))
    {
        throw new SoapException("Invalid or expired session token.", SoapException.ClientFaultCode);
    }
    
    // Fetch and return the user's configured items
}

4. Integrate with Your MVC Frontend #

In your MVC app, when a user logs in via the MVC login form, you can either:

• Use the MVC authentication system (e.g., FormsAuthentication.SetAuthCookie) and then call the SOAP service's Login method to create a matching session for the service.
• Or, directly call the SOAP service's Login method from your MVC login action, store the session token in the MVC user's session or cookie, and use it for all future SOAP requests.

Example MVC login action snippet:

[HttpPost]
public ActionResult Login(LoginViewModel model)
{
    if (ModelState.IsValid)
    {
        var soapService = new YourSoapService();
        var userSession = soapService.Login(model.Username, model.Password);
        
        if (userSession != null)
        {
            // Store the session token in a cookie or session
            Session["SoapSessionToken"] = userSession.Token;
            return RedirectToAction("Index", "Home");
        }
        ModelState.AddModelError("", "Invalid username or password.");
    }
    return View(model);
}

5. Critical Security Best Practices #

• Always use HTTPS: Never send passwords or session tokens over unencrypted HTTP.
• Hash passwords: Never store plain-text passwords in your database. Use a strong hashing library like BCrypt or ASP.NET's built-in password hashing.
• Expire sessions: Set a reasonable expiration time for session tokens and clean up expired sessions from your DB regularly.
• Validate input: Sanitize all input to your SOAP service to prevent SQL injection and other attacks.

内容的提问来源于stack exchange，提问作者bryken