c# - 如何在 MVC 中显示 Asp.net 身份 cookie 过期弹出窗口

Question

我有 MVC 5 Web API 应用程序，它使用 Asp.net 身份进行身份验证和授权。这是单页应用程序，用户可以使用电子邮件和密码登录。如果用户闲置一段时间，我必须显示 session 过期弹出窗口。

我试过在 web.config 中使用 Session.Timeout。它不起作用，因为我的应用程序不会刷新。所有客户端都使用 AJAX 与服务器通信。

如何显示基于 cookie 超时的 session 过期弹出窗口？

    public void ConfigureAuth(IAppBuilder app)
    {

        string expireTimeConfig = WebConfigurationManager.AppSettings["ExpireTime"];
        int expireTimeSpan = Convert.ToInt32(expireTimeConfig);
        // Enable the application to use a cookie to store information for the signed in user
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            CookieName = "APP",
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            ExpireTimeSpan = TimeSpan.FromMinutes(expireTimeSpan),
            SlidingExpiration = true,
            Provider = new CookieAuthenticationProvider()
            {
                //  OnValidateIdentity = MyCustomValidateIdentity, //refer to the implementation below
                //    OnValidateIdentity = ImpersonatingSecurityStampValidator.OnValidateIdentity<UserManager, User>(
                //validateInterval: TimeSpan.FromMinutes(10),
                //regenerateIdentity: (manager, user) => manager.CreateIdentityAsync(user)),

                OnApplyRedirect = ctx =>
                {
                    if (!IsApiRequest(ctx.Request))
                    {
                        ctx.Response.Redirect(ctx.RedirectUri);
                    }
                },
                OnResponseSignIn = ctx =>
                {
                    var ticks = ctx.Options.SystemClock.UtcNow.AddHours(10).UtcTicks;
                    ctx.Properties.Dictionary.Add("absolute", ticks.ToString());
                },
                OnValidateIdentity = ctx =>
                {
                    bool reject = true;
                    string value;
                    if (ctx.Properties.Dictionary.TryGetValue("absolute", out value))
                    {
                        long ticks;
                        if (Int64.TryParse(value, out ticks))
                        {
                            reject = ctx.Options.SystemClock.UtcNow.UtcTicks > ticks;
                        }
                    }

                    if (reject)
                    {
                        ctx.RejectIdentity();
                        // optionally clear cookie
                        ctx.OwinContext.Authentication.SignOut(ctx.Options.AuthenticationType);
                    }

                    return Task.FromResult(0);
                }

            },


        });
        // Use a cookie to temporarily store information about a user logging in with a third party login provider
        app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);


        if (Convert.ToBoolean(WebConfigurationManager.AppSettings["OAuth"].ToString()))
        {
            // Uncomment the following lines to enable logging in with third party login providers
            app.UseMicrosoftAccountAuthentication(new MicrosoftAccountAuthenticationOptions
            {
                ClientId = WebConfigurationManager.AppSettings["microsoftClientId"].ToString(),
                ClientSecret = WebConfigurationManager.AppSettings["microsoftClientSecret"].ToString(),
                Scope =
            {
                "wl.basic", "wl.emails"
            }
            });

            app.UseTwitterAuthentication(
               consumerKey: WebConfigurationManager.AppSettings["twitterConsumerKey"].ToString(),
               consumerSecret: WebConfigurationManager.AppSettings["twitterConsumerSecret"].ToString());

            app.UseFacebookAuthentication(new FacebookAuthenticationOptions
            {
                AppId = WebConfigurationManager.AppSettings["facebookAppId"].ToString(),
                AppSecret = WebConfigurationManager.AppSettings["facebookAppSecret"].ToString(),
                Scope = { "email" }
            });

            var options = new GoogleOAuth2AuthenticationOptions
            {
                ClientId = WebConfigurationManager.AppSettings["googleClientId"].ToString(),
                ClientSecret = WebConfigurationManager.AppSettings["googleClientSecret"].ToString(),
                Provider = new GoogleOAuth2AuthenticationProvider
                {
                    OnAuthenticated = async context =>
                    {
                        string accessToken = context.AccessToken;

                        // Retrieve the name of the user in Google
                        string googleName = context.Name;

                        // Retrieve the user's email address
                        string googleEmailAddress = context.Email;

                        // You can even retrieve the full JSON-serialized user
                        var serializedUser = context.User;
                    }
                }
            };

            app.UseGoogleAuthentication(options);

            app.UseLinkedInAuthentication(
                clientId: WebConfigurationManager.AppSettings["linkedInClientId"].ToString(),
                clientSecret: WebConfigurationManager.AppSettings["linkedInClientSecret"].ToString());

            app.UseYahooAuthentication(consumerKey: WebConfigurationManager.AppSettings["yahooConsumerKey"].ToString(),
                consumerSecret: WebConfigurationManager.AppSettings["yahooConsumerSecret"].ToString());

        }

        // app.UseKentorAuthServicesAuthentication(CreateAuthServicesOptions( ));

        app.MapSignalR();


    }

我如何在客户端读取 ExpireTimeSpan 并显示 session 超时弹出窗口？

Answer 1

基本上是将 onload 添加到调用 StartTimers() 的 body 标记中。您还可以将 onmousemove 添加到调用 ResetTimer() 的 body 标记，这样只要页面上有事件，就不会触发超时。如果在页面上没有看到鼠标事件，则显示对话框如果检测到移动，则关闭对话框并重置计时器。

例子:

// Set timeout variables.
var timoutWarning = 60000; // Display warning in 1Mins.
var timoutNow = 120000; // Timeout in 2 mins.
var logoutUrl = 'http://www.asp.net; // URL to logout page.

var warningTimer;
var timeoutTimer;

// Start timers.
function StartTimers() {
    warningTimer = setTimeout("IdleWarning()", timoutWarning);
    timeoutTimer = setTimeout("IdleTimeout()", timoutNow);
}

// Reset timers.
function ResetTimers() {
    clearTimeout(warningTimer);
    clearTimeout(timeoutTimer);
    StartTimers();
    $("#timeout").dialog('close');
}

// Show idle timeout warning dialog.
function IdleWarning() {
    $("#timeout").dialog({
        modal: true
    });
}

// Logout the user.
function IdleTimeout() {
    window.location = logoutUrl;
}

<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <link rel="shortcut icon" href="" type="image/x-icon" />
</head>
<body onload="StartTimers();" onmousemove="ResetTimers();">
    <form id="form1" runat="server">
    <div id="timeout">
        <h1>
            Session About To Timeout</h1>
        <p>
            You will be automatically logged out in 1 minute.<br />
        To remain logged in move your mouse over this window.
    </div>
    <table id="table1" align="center" border="1" width="800" cellpadding="0" cellspacing="0">
        <tr>
            <td>
                Hello World
            </td>
        </tr>
    </table>
    </form>
</body>
</html>