我做了一个角色权限验证的,在admin文件夹下有文件

web.config

代码为:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <authorization>
          <allow roles="superadmin,admin" />
          <deny users="*" />
        </authorization>
    </system.web>
</configuration>

Global.asax下的代码为:

    protected void Application_AuthorizeRequest(object sender, EventArgs e)
    {
        HttpApplication App = (HttpApplication)sender;
        HttpContext Ctx = App.Context;
        if (Ctx.Request.IsAuthenticated == true)
        {
            FormsIdentity Id = (FormsIdentity)Ctx.User.Identity;
            FormsAuthenticationTicket Ticket = Id.Ticket;
            string[] roles = Ticket.UserData.Split(',');
            Ctx.User = new System.Security.Principal.GenericPrincipal(Id, roles);
        }
    }

login.aspx登录部分代码:

   protected void Lg_Click(object sender, EventArgs e)
    {
        if (string.IsNullOrEmpty(this.User_Name.Text.Trim()) || string.IsNullOrEmpty(this.User_Password.Text.Trim()))
        {
            ClientScript.RegisterStartupScript(GetType(), "message", "<script>alert('用户名和密码不能为空');</script>");
            return;
        }
        string UserRule = string.Empty; ;
        if (CheckUser(ref UserRule))
        {
            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, this.User_Name.Text, DateTime.Now, DateTime.Now.AddMinutes(30), true, UserRule.Trim(), FormsAuthentication.FormsCookiePath);
            string hash = FormsAuthentication.Encrypt(ticket);
            HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hash);
            if (ticket.IsPersistent)
                cookie.Expires = ticket.Expiration;
            Response.Cookies.Add(cookie);
            string returnUrl = Request.QueryString["ReturnUrl"];
            if (string.IsNullOrEmpty(returnUrl))
            {
                returnUrl = FormsAuthentication.DefaultUrl;
            }
            Response.Redirect(returnUrl);
        }
        else
        {
            ClientScript.RegisterStartupScript(GetType(), "message", "<script>alert('用户名或密码错误');</script>");
        }
    }

不知道为什么这样总是登录不了,

把

web.config改为:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <authorization>
          <deny users="?"/>
          <allow roles="superadmin,admin" />
        </authorization>
    </system.web>
</configuration>

就可以登录成功

而且用 HttpContext.Current.User.IsInRole("superadmin").ToString() 为true

但是这样的话什么角色都可以登录了,请教各位高手我的问题出现在哪里?