Làm thế nào để thực hiện xác thực dựa trên Form trong ứng dụng ASP.NET

if exists (select * from sysobjects where id = 
object_id(N'[dbo].[Users]') and OBJECTPROPERTY(id, N'IsUserTable') = 1)
drop table [dbo].[Users]
GO
CREATE TABLE [dbo].[Users] (
    [uname] [varchar] (15) NOT NULL ,
    [Pwd] [varchar] (25) NOT NULL ,
    [userRole] [varchar] (25) NOT NULL ,
) ON [PRIMARY]
GO
ALTER TABLE [dbo].[Users] WITH NOCHECK ADD 
    CONSTRAINT [PK_Users] PRIMARY KEY  NONCLUSTERED 
    (
        [uname]
    )  ON [PRIMARY] 
GO

INSERT INTO Users values('user1','user1','Manager')
INSERT INTO Users values('user2','user2','Admin')
INSERT INTO Users values('user3','user3','User')
GO

Imports System.Data.SqlClient
Imports System.Web.Security

using System.Data.SqlClient;
using System.Web.Security;

Private Function ValidateUser(ByVal userName As String, ByVal passWord As String) As Boolean
        Dim conn As SqlConnection
        Dim cmd As SqlCommand
        Dim lookupPassword As String

        lookupPassword = Nothing

        ' Check for an invalid userName.
        ' userName  must not be set to nothing and must be between one and 15 characters.
        If ((userName Is Nothing)) Then
            System.Diagnostics.Trace.WriteLine("[ValidateUser] Input validation of userName failed.")
            Return False
        End If
        If ((userName.Length = 0) Or (userName.Length > 15)) Then
            System.Diagnostics.Trace.WriteLine("[ValidateUser] Input validation of userName failed.")
            Return False
        End If

        ' Check for invalid passWord.
        ' passWord must not be set to nothing and must be between one and 25 characters.
        If (passWord Is Nothing) Then
            System.Diagnostics.Trace.WriteLine("[ValidateUser] Input validation of passWord failed.")
            Return False
        End If
        If ((passWord.Length = 0) Or (passWord.Length > 25)) Then
            System.Diagnostics.Trace.WriteLine("[ValidateUser] Input validation of passWord failed.")
            Return False
        End If

        Try
            ' Consult with your SQL Server administrator for an appropriate connection
            ' string to use to connect to your local SQL Server.
            conn = New SqlConnection("server=localhost;Integrated Security=SSPI;database=pubs")
            conn.Open()

            ' Create SqlCommand to select pwd field from the users table given a supplied userName.
            cmd = New SqlCommand("Select pwd from users where uname=@userName", conn)
            cmd.Parameters.Add("@userName", SqlDbType.VarChar, 25)
            cmd.Parameters("@userName").Value = userName


            ' Execute command and fetch pwd field into lookupPassword string.
            lookupPassword = cmd.ExecuteScalar()

            ' Cleanup command and connection objects.
            cmd.Dispose()
            conn.Dispose()
        Catch ex As Exception
            ' Add error handling here for debugging.
            ' This error message should not be sent back to the caller.
            System.Diagnostics.Trace.WriteLine("[ValidateUser] Exception " & ex.Message)
        End Try

        ' If no password found, return false.
        If (lookupPassword Is Nothing) Then
            ' You could write failed login attempts here to the event log for additional security.
            Return False
        End If

        ' Compare lookupPassword and input passWord by using a case-sensitive comparison.
        Return (String.Compare(lookupPassword, passWord, False) = 0)

End Function

private bool ValidateUser( string userName, string passWord )
{
    SqlConnection conn;
    SqlCommand cmd;
    string lookupPassword = null;

    // Check for invalid userName.
    // userName must not be null and must be between 1 and 15 characters.
    if ( (  null == userName ) || ( 0 == userName.Length ) || ( userName.Length > 15 ) )
    {
        System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of userName failed." );
        return false;
    }

    // Check for invalid passWord.
    // passWord must not be null and must be between 1 and 25 characters.
    if ( (  null == passWord ) || ( 0 == passWord.Length ) || ( passWord.Length > 25 ) )
    {
        System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of passWord failed." );
        return false;
    }

    try
    {
        // Consult with your SQL Server administrator for an appropriate connection
        // string to use to connect to your local SQL Server.
        conn = new SqlConnection( "server=localhost;Integrated Security=SSPI;database=pubs" );
        conn.Open();

        // Create SqlCommand to select pwd field from users table given supplied userName.
        cmd = new SqlCommand( "Select pwd from users where uname=@userName", conn );
        cmd.Parameters.Add( "@userName", SqlDbType.VarChar, 25 );
        cmd.Parameters["@userName"].Value = userName;

        // Execute command and fetch pwd field into lookupPassword string.
        lookupPassword = (string) cmd.ExecuteScalar();

        // Cleanup command and connection objects.
        cmd.Dispose();
        conn.Dispose();
    }
    catch ( Exception ex )
    {
        // Add error handling here for debugging.
        // This error message should not be sent back to the caller.
        System.Diagnostics.Trace.WriteLine( "[ValidateUser] Exception " + ex.Message );
    }

    // If no password found, return false.
    if ( null == lookupPassword ) 
    {
        // You could write failed login attempts here to event log for additional security.
        return false;
    }

    // Compare lookupPassword and input passWord, using a case-sensitive comparison.
    return ( 0 == string.Compare( lookupPassword, passWord, false ) );

}

Private Sub cmdLogin_ServerClick(ByVal sender As Object, ByVal e As System.EventArgs) _
   Handles cmdLogin.ServerClick
   If ValidateUser(txtUserName.Value,txtUserPass.value) Then
      FormsAuthentication.RedirectFromLoginPage(txtUserName.Value, _
      chkPersistCookie.Checked)
   Else
      Response.Redirect("logon.aspx", True)
   End If
End Sub

private void cmdLogin_ServerClick(object sender, System.EventArgs e)
{
if (ValidateUser(txtUserName.Value,txtUserPass.Value) )
    FormsAuthentication.RedirectFromLoginPage(txtUserName.Value,
        chkPersistCookie.Checked);
    else
        Response.Redirect("logon.aspx", true);
}

Private Sub cmdLogin_ServerClick(ByVal sender As Object, _
   ByVal e As System.EventArgs) Handles cmdLogin.ServerClick
   If Validateuser(txtUserName.Value,txtUserPass.Value) Then
      Dim tkt As FormsAuthenticationTicket
      Dim cookiestr As String
      Dim ck As HttpCookie

      tkt = New FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now(), _
dateTime.Now.AddMinutes(30), chkPersistCookie.Checked, "your custom data")
      cookiestr = FormsAuthentication.Encrypt(tkt)
      ck = new HttpCookie(FormsAuthentication.FormsCookieName(), cookiestr)
      if (chkPersistCookie.Checked) then ck.Expires=tkt.Expiration 
      ck.Path = FormsAuthentication.FormsCookiePath() 
      Response.Cookies.Add(ck)

      Dim strRedirect As String
      strRedirect = Request("ReturnURL")
      If strRedirect <> "" Then
         Response.Redirect(strRedirect, True)
      Else
         strRedirect = "default.aspx"
         Response.Redirect(strRedirect, True)
      End If
   Else
      Response.Redirect("logon.aspx", True)
   End If
End Sub

private void cmdLogin_ServerClick(object sender, System.EventArgs e)
{
   if (ValidateUser(txtUserName.Value,txtUserPass.Value) )
   {
      FormsAuthenticationTicket tkt;
      string cookiestr;
      HttpCookie ck;
      tkt = new FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now, 
DateTime.Now.AddMinutes(30), chkPersistCookie.Checked, "your custom data");
      cookiestr = FormsAuthentication.Encrypt(tkt);
      ck = new HttpCookie(FormsAuthentication.FormsCookieName, cookiestr);
      if (chkPersistCookie.Checked)
      ck.Expires=tkt.Expiration;    
            ck.Path = FormsAuthentication.FormsCookiePath; 
      Response.Cookies.Add(ck);

      string strRedirect;
      strRedirect = Request["ReturnUrl"];
      if (strRedirect==null)
            strRedirect = "default.aspx";
         Response.Redirect(strRedirect, true);
   }
   else
      Response.Redirect("logon.aspx", true);
}
    

Private Sub cmdSignOut_ServerClick(ByVal sender As System.Object, ByVal e As System.EventArgs) _
Handles cmdSignOut.ServerClick
   FormsAuthentication.SignOut()
   Response.Redirect("logon.aspx", True)
End Sub

this.cmdLogin.ServerClick += new System.EventHandler(this.cmdLogin_ServerClick);