ASP.NET Forms 認證入門完整示例：Web.config、登錄頁、受保護頁

1. Web.config 配置

<configuration>
  <system.web>
    <compilation debug="true" />
    <authentication mode="Forms">
      <forms loginUrl="login.aspx" name=".ASPXFORMSAUTH" />
    </authentication>
    <authorization>
      <deny users="?" /> <!-- 拒絕匿名用戶 -->
    </authorization>
  </system.web>
</configuration>

2. 登錄頁

<%@ Page Language="C#" %>
<script runat="server">
void Page_Load(object sender, EventArgs e)
{
    if (Request.IsAuthenticated) Response.Redirect("default.aspx");
}

void btnLogin_Click(object sender, EventArgs e)
{
    if (!string.IsNullOrEmpty(txtUsername.Text) && !string.IsNullOrEmpty(txtPassword.Text))
    {
        // 此處應驗證數據庫，示例直接通過
        FormsAuthentication.RedirectFromLoginPage(txtUsername.Text, true); // true = 持久 Cookie
    }
    else
    {
        lblError.Text = "錯誤的用戶名/密碼";
    }
}
</script>
<html><body>
<form runat="server">
<asp:Label Text="用戶名：" AssociatedControlID="txtUsername" runat="server" />
<asp:TextBox ID="txtUsername" runat="server" /><br><br>
<asp:Label Text="密碼：" AssociatedControlID="txtPassword" runat="server" />
<asp:TextBox ID="txtPassword" TextMode="Password" runat="server" /><br>
<asp:Button ID="btnLogin" Text="登錄" OnClick="btnLogin_Click" runat="server" />
<hr>
<asp:Label ID="lblError" ForeColor="red" runat="server" />
</form>
</body></html>

3. 受保護頁面

<%@ Page Language="VB" %>
<script runat="server">
Sub Page_Load(Sender As Object, E As EventArgs)
    Message.Text = String.Format("你好，{0}", Context.User.Identity.Name)
End Sub

Sub btnSignout_Click(Sender As Object, E As EventArgs)
    FormsAuthentication.SignOut()
    Response.Redirect("login.aspx")
End Sub
</script>
<html><body>
<asp:Label ID="Message" runat="server" /><br>
<form runat="server">
<asp:Button ID="btnSignout" Text="退出登錄" OnClick="btnSignout_Click" runat="server" />
</form>
</body></html>

關鍵點總結

• `` 觸發未認證用戶自動跳轉到 `loginUrl`。
• `FormsAuthentication.RedirectFromLoginPage` 自動創建加密 Cookie 並跳回原請求頁（或 `DefaultUrl`）。
• `FormsAuthentication.SignOut()` 清除 Cookie，建議配合 `Response.Redirect` 跳轉登錄頁。
• 生產環境**必須**：密碼哈希存儲（BCrypt/PBKDF2）、HTTPS 傳輸、防暴力破解、Cookie 設置 `HttpOnly`、`Secure`、`SameSite`。