asp.net成员身份IsApproved为false但仍允许登录

Question

我已更改默认帐户成员资格提供程序以将IsApproved设置为false.

    public MembershipCreateStatus CreateUser(string userName, string password, string email)
    {
        MembershipCreateStatus status;
        _provider.CreateUser(userName, password, email, null, null, false, null, out status);
        return status;
    }

但我然后回到登录页面,它允许我登录.不应该登录失败并说我不被批准？

编辑:

    [AcceptVerbs(HttpVerbs.Post)]
    public ActionResult Register(string userName, string email, string password, string confirmPassword, string address, string address2, string city, string state, string homePhone, string cellPhone, string company)
    {

        ViewData["PasswordLength"] = MembershipService.MinPasswordLength;

        if (ValidateRegistration(userName, email, password, confirmPassword))
        {

            // Attempt to register the user
            MembershipCreateStatus createStatus = MembershipService.CreateUser(userName, password, email);

            if (createStatus == MembershipCreateStatus.Success)
            {
                FormsAuth.SignIn(userName, false /* createPersistentCookie */);

                TempData["form"] = Request.Form;
                TempData["isActive"] = false;
                return RedirectToAction("Create", "Users");
            }
            else
            {
                ModelState.AddModelError("_FORM", ErrorCodeToString(createStatus));
            }
        }

        // If we got this far, something failed, redisplay form
        return View();
    }

Answer 1

(看起来这个问题的另一个副本将被关闭,所以我在这里复制了我的答案)

HttpRequest.IsAuthenticated如果HttpContext.User.Identity不为空,它的IsAuthenticated属性返回true,则返回true.

当前标识在FormsAuthenticationModule中设置,但它与MembershipProvider无关.实际上,它甚至没有引用它.它只是检查验证cookie是否仍然设置并且仍然有效(因为,尚未过期).

我认为问题是您正在调用其中一个FormsAuthentication方法,如RedirectFromLoginPage,这是设置身份验证cookie.如果您需要等到用户获得批准,那么您需要确保没有设置cookie.

更新

没有MembershipCreateStatus的值指定用户已创建但未批准,因此您的代码正在调用FormsAuth.SignIn而不实际检查用户是否已获得批准.

FormsAuth.SignIn只是设置cookie,就是这样.它不会验证用户或与您的MembershipProvider有任何关系.如果批准是异步的(即等待人员),则不要通过调用FormsAuth.SignIn自动登录用户.