Missing Function Access Control
Access to these functionalities should be restricted to authenticated users. However, the current mechanism only checks whether a user exists. Any user, authenticated or not, will be able to access restricted information.
Using built-in .NET framework functionality it is possible to check if a user is properly authenticated.
标签：Web,Code,authenticated,10,Introduction,Top,user,Warrior From： https://www.cnblogs.com/chucklu/p/17766983.html