我們是否可以爲ASP.NET MVC中的角色個性化會話超時5

Question

這個想法是爲ASP.NET MVC 5和ASP.NET身份中的 不同用戶角色設置不同的會話超時值。

可以嗎？

Answer 1

根據他們的，你可以設置超時的作用，即

HttpContext.Current.Session.Timeout = 20; 

你前面的問題去要動態地做到這一點。您可以在會話中自行存儲和更新時間，併爲基本控制器的每個角色OnActionExecuting進行設置。

if (User.IsInRole("Admin")) 
    { 
     filterContext.HttpContext.Session.Timeout = 
(int)filterContext.HttpContext.Session["AdminTimeoutThatYouSetSomewhereElseGlobally"]; 
    } 

Answer 2

如果您試圖比常規用戶更快地啓動管理員，以下是我在標識中的存根。

app.UseCookieAuthentication(new CookieAuthenticationOptions 
{ 
    // other stuff 
    Provider = new CookieAuthenticationProvider 
    { 
     // this function is executed every http request and executed very early in the pipeline 
     // and here you have access to cookie properties and other low-level stuff. 
     // makes sense to have the invalidation here 
     OnValidateIdentity = async context => 
     { 
      // invalidate user cookie if user's security stamp have changed 
      var invalidateBySecirityStamp = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
        validateInterval: TimeSpan.FromMinutes(30), 
        regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager)); 
      await invalidateBySecirityStamp.Invoke(context); 

      // check if user is in admin role 
      var isAdmin = context.Identity.Claims.Any(c => c.Type == ClaimTypes.Role && c.Value == "AdminRoleName"); 

      // check if enough time has passed to invalidate cookie 
      var currentUtc = DateTimeOffset.UtcNow; 
      if (context.Options != null && context.Options.SystemClock != null) 
      { 
       currentUtc = context.Options.SystemClock.UtcNow; 
      } 

      var issuedUtc = context.Properties.IssuedUtc; 
      var bootThemOut = (issuedUtc == null); 
      if (issuedUtc != null) 
      { 
       var timeElapsed = currentUtc.Subtract(issuedUtc.Value); 
       bootThemOut = timeElapsed > TimeSpan.FromMinutes(3); // invalidate admin cookies in 3 minutes 
      } 

      if (isAdmin && bootThemOut) 
      { 
       context.RejectIdentity(); 
       context.OwinContext.Authentication.SignOut(context.Options.AuthenticationType); 
      } 
     } 
    } 
});