public static void SignIn(User user, bool isPersistent)
        {
            // 如果登录成功 则做此设置 表明验证通过
            // 输入的 username 用来作为登录验证票据 tick 的一部分
            // persistence cookie 如果为false 则为回话cookie 浏览器关闭就失效，如果为 true 则有效期为配置中的 timeout
            FormsAuthentication.SetAuthCookie(user.UserName, isPersistent); // 此方法设置要安全可靠

            CookieHelper.SetAuthCookieTicket(user);
            CookieHelper.SetUserCookie(user);
        }

 public static class CookieHelper
    {
        private const string UserCookieName = "user";

        public static void SetAuthCookieTicket(User user)
        {
            var response = HttpContext.Current.Response;
            var cookie = response.Cookies.Get(FormsAuthentication.FormsCookieName);
            if (cookie == null) return;

            var permissions = new List<string>();
            user.Groups
                .Select(g => g.Permissions.Select(p => p.Name))
                .ForEach(p => permissions = permissions.Union(p).ToList());

            var oldTicket = FormsAuthentication.Decrypt(cookie.Value);
            if (oldTicket == null) return;

            var newTicket = new FormsAuthenticationTicket(oldTicket.Version,
                oldTicket.Name,
                oldTicket.IssueDate,
                oldTicket.Expiration,
                oldTicket.IsPersistent,
                permissions.Join(",")
                );

            cookie.Value = FormsAuthentication.Encrypt(newTicket);
        }

        public static void SetUserCookie(User user)
        {
            var cookie = new HttpCookie(UserCookieName)
            {
                Expires = DateTime.UtcNow.Add(FormsAuthentication.Timeout),
                Secure = FormsAuthentication.RequireSSL,
                HttpOnly = true
            };

            cookie.Values.Add("uid", user.Id.ToString(CultureInfo.InvariantCulture));
            //cookie.Values.Add("username", user.UserName);
            cookie.Values.Add("displayname", user.DisplayName);

            HttpContext.Current.Response.Cookies.Add(cookie);
        }

        public static void ClearUserCookie()
        {
            var response = HttpContext.Current.Response;
            var cookie = new HttpCookie(UserCookieName)
            {
                HttpOnly = true,
                Expires = new DateTime(0x7cf, 10, 12) //0x7cf 1999
            };

            response.Cookies.Remove(UserCookieName);
            response.Cookies.Add(cookie);
        }

        public static User GetUserFromCookie()
        {
            var user = new User();
            var cookie = HttpContext.Current.Request.Cookies[UserCookieName];
            if (cookie != null)
            {
                user.Id = cookie["uid"].AsInt();
                //user.UserName = cookie["username"];
                user.DisplayName = cookie["displayname"];
            }

            return user;
        }
    }