当用户访问我的网站时,他们会看到登录页面。一旦他们成功登录,他们就可以注销并且其他用户可以登录。但是,如果用户在登录时单击后退按钮,则会转到登录页面。此时新用户无法再登录。我收到防伪令牌错误。
我尝试注销任何进入登录页面的用户。我尝试过不同的注销方法。我什至尝试过Session.Abandon();
账户控制者:
// GET: /Account/Login
[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
EnsureLoggedOut();
ViewBag.ReturnUrl = returnUrl;
// Store the originating URL so we can attach it to a form field
var viewModel = new LoginViewModel { ReturnUrl = returnUrl };
return View(viewModel);
}
// POST: /Account/Login
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
{
if (!ModelState.IsValid)
{
return View(model);
}
ApplicationUser user = new ApplicationUser();
try
{
user = DBcontext.Users.Where(u => u.Email.Equals(model.Email)).Single(); // where db is ApplicationDbContext instance
}
catch (InvalidOperationException)
{
// the user is not exist
return View("The user does not exist.");
}
var result = await SignInManager.PasswordSignInAsync(user.UserName, model.Password, model.RememberMe, shouldLockout: false);
SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: false);
switch (result)
{
case SignInStatus.Success:
return RedirectToLocal(returnUrl);
case SignInStatus.LockedOut:
return View("Lockout");
case SignInStatus.RequiresVerification:
return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
case SignInStatus.Failure:
default:
ModelState.AddModelError("", "Invalid login attempt.");
return View(model);
}
}
// POST: /Account/LogOff
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult LogOff()
{ Session.Abandon();
AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
return RedirectToAction("Index", "Home");
}
private ActionResult RedirectToLocal(string returnUrl)
{
if (Url.IsLocalUrl(returnUrl))
{
return Redirect(returnUrl);
}
return RedirectToAction("Index", "Home");
}
}
登录查看:
@model LoginViewModel
@{ViewBag.PageId = "extr-page";
ViewBag.PageClass = "animated fadeInDown";}
@section topright{<span id="extr-page-header-space"> <span class="hidden-mobile">Need an account?</span> <a href="@Url.Action("register", "account")" class="btn btn-danger">Create account</a> </span>
}
<div id="content" class="container">
<div class="row">
@{ Html.RenderPartial("_LoginText"); }
<div class="col-xs-12 col-sm-12 col-md-5 col-lg-4">
<div class="well no-padding">
<form action="@Url.Action("Login", "Account")" method="POST" id="login-form" class="smart-form client-form">
<header>
Sign In
</header>
@Html.HiddenFor(m => m.ReturnUrl)
@Html.AntiForgeryToken()
@Html.ValidationBootstrap()
<fieldset>
<section>
<label class="label">E-mail</label>
<label class="input">
<i class="icon-append fa fa-user"></i>
<input type="Email" name="Email" value="[email protected] /cdn-cgi/l/email-protection">
<b class="tooltip tooltip-top-right"><i class="fa fa-user txt-color-teal"></i> Please enter email address/username</b>
</label>
</section>
<section>
<label class="label">Password</label>
<label class="input">
<i class="icon-append fa fa-lock"></i>
<input type="Password" name="Password" value="demo">
<b class="tooltip tooltip-top-right"><i class="fa fa-lock txt-color-teal"></i> Enter your password</b>
</label>
<div class="note">
<a href="@Url.Action("forgotpassword", "Account")"><i class="fa fa-frown-o"></i> Forgot password?</a>
</div>
</section>
<section>
<label class="checkbox">
<input type="checkbox" name="RememberMe" value="true" checked="checked">
<input type="hidden" name="RememberMe" value="false" />
<i></i>Stay signed in
</label>
</section>
</fieldset>
<footer>
<button type="submit" class="btn btn-primary">
Sign in
</button>
</footer>
</form>
</div>
@{ Html.RenderPartial("_SocialMedia"); }
</div>
</div>
我希望当用户点击后退按钮并进入登录页面时,前一个用户会被注销。
更新1:需要明确的是,我并不担心刚刚注销并点击后退按钮的用户。相反,当用户成功登录然后点击后退按钮时,我的网站就会崩溃。它将他们带回登录页面,但由于上述防伪造错误,用户名或密码不起作用。
更新2:我在IE中测试了代码,没有问题。经过进一步研究,当我点击后退按钮时,Chrome 似乎正在保存身份验证 cookie。然而,当我正确注销时,cookie 就会被破坏。我认为当登录页面加载时我正在调用 LogOff 方法,但它并没有删除 cookie。我将继续研究这个问题。也许有人有这方面的经验?
更新3:我确实注意到,当我点击返回按钮时,cookie 没有被删除。当我正确注销时,cookie 就会被删除。当我没有使用下面 Shoe 的方法缓存页面时,点击后退 btn 时 cookie 会被删除。但是,我仍然收到防伪令牌错误。有趣的是,我有一部分标题会在登录页面上弹出。该标头仅应在用户经过身份验证时出现。还应该有一个在身份验证时弹出的旁边菜单。但事实并非如此。我想知道是否有异步问题导致了这两个问题。