ASP.NET FORM验证

if (ValidateUser(txtUserName.Value, txtUserPass.Value))  //判断是否是合法用户
        {
            FormsAuthenticationTicket tkt;
            string cookiestr;
            HttpCookie cookie;
            tkt = new FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now,
      DateTime.Now.AddMinutes(30), chkPersistCookie.Checked, "your custom data");
            cookiestr = FormsAuthentication.Encrypt(tkt);
            cookie = new HttpCookie(FormsAuthentication.FormsCookieName, cookiestr);
            if (chkPersistCookie.Checked)
                cookie.Expires = tkt.Expiration;
            cookie.Path = FormsAuthentication.FormsCookiePath;
            Response.Cookies.Add(cookie);

            string strRedirect= "default.aspx";;
            strRedirect = Request["ReturnUrl"];
            Response.Redirect(strRedirect, true);
        }

当验证成功后，先创建一个票据，将该票据加密成字符串放到cookie里面，不放也可以，因为当用户登录成功后我们更多用的是用户名称，该名称可以从user.Identity.Name 中得到，所以本人认为写cookie意义不大。在跳转到的页面就可以用user.Identity.Name 取得用户的信息了。不过如果象CSDN那样可以两周之内不用登陆就得用cookie了，可以在login.aspx页面的page_init事件写

        HttpCookieCollection cookieCollection = Request.Cookies;
        if (cookieCollection[FormsAuthentication.FormsCookieName] != null)
            FormsAuthentication.RedirectFromLoginPage(FormsAuthentication.FormsCookieName, true);

在票据里面设置cookie的过期时间就可以了。