thinkyu/報到系統/Services/LoginService.asmx.cs

using System;
using System.Web;
using System.Web.Script.Services;
using System.Web.Security;
using System.Web.Services;
using System.Xml.Serialization;

namespace 報到系統
{
    [WebService(Namespace = "http://tempuri.org/")]
    [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
    [System.ComponentModel.ToolboxItem(false)]
    [ScriptService]
    public class LoginService : System.Web.Services.WebService
    {
        [WebMethod(EnableSession = true)]
        [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
        public BaseResponse Login(string username, string password, bool rememberMe)
        {
            try
            {
                // 驗證輸入
                if (string.IsNullOrEmpty(username))
                {
                    return new BaseResponse
                    {
                        Success = false,
                        Message = "請輸入帳號和密碼"
                    };
                }

                // 驗證使用者
                if (ValidateUser(username, password))
                {
                    // 設定 Session (ValidateUser 已設定使用者相關資訊)
                    Session["LoginTime"] = DateTime.Now;

                    return new BaseResponse
                    {
                        Success = true,
                        Message = "登入成功",
                        Data = new {
                            UserID = username,
                            UserName = Session[PublicVariable.UserName] != null ? Session[PublicVariable.UserName].ToString() : username
                        }                        
                    };
                }
                else
                {
                    return new BaseResponse
                    {
                        Success = false,
                        Message = "帳號或密碼錯誤"
                    };
                }
            }
            catch (Exception ex)
            {
                return new BaseResponse
                {
                    Success = false,
                    Message = "登入發生錯誤：" + ex.Message
                };
            }
        }

        [WebMethod(EnableSession = true)]
        [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
        public BaseResponse Logout()
        {
            try
            {
                FormsAuthentication.SignOut();
                Session.Clear();
                Session.Abandon();

                return new BaseResponse
                {
                    Success = true,
                    Message = "登出成功"
                };
            }
            catch (Exception ex)
            {
                return new BaseResponse
                {
                    Success = false,
                    Message = "登出發生錯誤：" + ex.Message
                };
            }
        }

        [WebMethod(EnableSession = true)]
        [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
        public BaseResponse CheckSession()
        {
            try
            {
                if (Session[PublicVariable.UserName] != null)
                {
                    return new BaseResponse
                    {
                        Success = true,
                        Message = "",
                        Data = new
                        {
                            UserID = Session[PublicVariable.UserId].ToString(),
                            UserName = Session[PublicVariable.UserName].ToString(),
                            LoginTime = Session["LoginTime"] != null ? (DateTime)Session["LoginTime"] : DateTime.MinValue
                        }
                    };
                }
                else
                {
                    return new BaseResponse
                    {
                        Success = false,
                        Message = "尚未登入"
                    };
                }
            }
            catch
            {
                return new BaseResponse
                {
                    Success = false,
                    Message = "尚未登入"
                };
            }
        }

        [WebMethod(EnableSession = true)]
        [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
        public BaseResponse Ping()
        {
            return new BaseResponse
            {
                Success = true
            };
        }
        private bool ValidateUser(string username, string password)
        {
            try
            {
                LoginBPSN loginBPSN = new LoginBPSN();
                loginBPSN.UserId = username;
                loginBPSN.Password = password;
                
                if (loginBPSN.GetResult())
                {
                    // 建立 Form 驗證票但不重定向（適用於 Web Service）
                    FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                        1,
                        loginBPSN.UserId,
                        DateTime.Now,
                        DateTime.Now.AddHours(24),
                        false,
                        string.Empty,
                        FormsAuthentication.FormsCookiePath
                    );
                    
                    string encryptedTicket = FormsAuthentication.Encrypt(ticket);
                    HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
                    // ✨ 關鍵修正: 明確設定 Cookie 屬性
                    authCookie.HttpOnly = true;
                    authCookie.Path = FormsAuthentication.FormsCookiePath;
                    authCookie.Expires = DateTime.Now.AddHours(24);
                    HttpContext.Current.Response.Cookies.Add(authCookie);

                    // 將使用者資訊儲存到 Session
                    Session[PublicVariable.UserId] = loginBPSN.UserId;
                    Session[PublicVariable.UserName] = loginBPSN.UserName;
                    Session[PublicVariable.IsSystemManager] = true || loginBPSN.IsSystemManager;
                    Session[PublicVariable.IsCustomManager] = true || loginBPSN.IsCustomManager;
                    Session[PublicVariable.IsFieldStaffWorker] = true || loginBPSN.IsFieldStaffWorker;
                    Session[PublicVariable.IsQueryWorker] = true || loginBPSN.IsQueryWorker;

                    // ✨ 強制儲存 Session
                    Session["LoginTime"] = DateTime.Now;
                    
                    return true;
                }
                
                return false;
            }
            catch
            {
                return false;
            }
        }
    }
}