public class FilterConfig
 {
  public static void RegisterGlobalFilters(GlobalFilterCollection filters)
  {
   filters.Add(new HandleErrorAttribute());
   //将内置的权限过滤器添加到全局过滤中
   filters.Add(new System.Web.Mvc.AuthorizeAttribute());
  }
 }

<system.web>
 <!--Cockie名称，当用未登入时跳转的url-->
 <authentication mode="Forms">
  <forms name="xCookie" loginUrl="~/Login/Index" protection="All" timeout="60" cookieless="UseCookies"></forms>
 </authentication>
 <compilation debug="true" targetFramework="4.5" />
 <httpRuntime targetFramework="4.5" />
 </system.web>

public class LoginController : Controller
 {
  [HttpGet]
  [AllowAnonymous]
  public ActionResult Index()
  {
   return View();
  }

  [HttpPost]
  [AllowAnonymous]
  public ActionResult Login(User user) 
  {
   if (!user.Username.Trim().Equals("liuxin") || !user.Password.Trim().Equals("abc"))
   {
    ModelState.AddModelError("", "用户名或密码错误");
    return View("index", user);
   }
   //if (!user.Username.Trim().Equals("liuxin")) {
   // ModelState.AddModelError("Username", "用户名错误");
   // return View("index", user);
   //}
   //if (!user.Password.Trim().Equals("abc")) {
   // ModelState.AddModelError("Password", "密码错误");
   // return View("index", user);
   //}
   user.Id = Guid.NewGuid().ToString("D");//为了测试手动设置一个用户id
   FormsAuthHelp.AddFormsAuthCookie(user.Id, user, 60);//设置ticket票据的名称为用户的id，设置有效时间为60分钟
   return Redirect("~");
  }
  [HttpGet]
  public ActionResult Logout() {
   FormsAuthHelp.RemoveFormsAuthCookie();
   return Redirect("~/Login/Index");
  }
 }

public class User
 {
  public string Id { get; set; }
  public string Username { get; set; }
  public string Password { get; set; }
 }

@{
 Layout = null;
 ViewBag.Title = "Index";
}
<h3>您尚未登入，请登入</h3>
@using(Html.BeginForm("Login", "Login", FormMethod.Post))
{
 @Html.Label("Username", "用户名:")@Html.TextBox("Username", null, new { id = "Username", placeholder = "请输入用户名" })
 @Html.ValidationMessage("Username")<br/>
 @Html.Label("Password", "密 码:")@Html.TextBox("Password", null, new { id = "Password", placeholder = "请输入密码" })
 @Html.ValidationMessage("Password")<br/>
 <input type="submit" value="登入" /> <input type="reset" value="重置" />
 @Html.ValidationSummary(true)
}

public class FormsAuthHelp
 {
  /// <summary>
  /// 将当前登入用户的信息生成ticket添加到到cookie中(用于登入)
  /// </summary>
  /// <param name="loginName">Forms身份验证票相关联的用户名(一般是当前用户的id，作为ticket的名称使用)</param>
  /// <param name="userData">用户信息</param>
  /// <param name="expireMin">有效期</param>
  public static void AddFormsAuthCookie(string loginName, object userData, int expireMin)
  {
   //将当前登入的用户信息序列化
   var data = JsonConvert.SerializeObject(userData);

   //创建一个FormsAuthenticationTicket，它包含登录名以及额外的用户数据。
   var ticket = new FormsAuthenticationTicket(1,
    loginName, DateTime.Now, DateTime.Now.AddDays(1), true, data);

   //加密Ticket，变成一个加密的字符串。
   var cookieValue = FormsAuthentication.Encrypt(ticket);

   //根据加密结果创建登录Cookie
   //FormsAuthentication.FormsCookieName是配置文件中指定的cookie名称，默认是".ASPXAUTH"
   var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, cookieValue)
   {
    HttpOnly = true,
    Secure = FormsAuthentication.RequireSSL,
    Domain = FormsAuthentication.CookieDomain,
    Path = FormsAuthentication.FormsCookiePath
   };
   //设置有效时间
   if (expireMin > 0)
    cookie.Expires = DateTime.Now.AddMinutes(expireMin);

   var context = HttpContext.Current;
   if (context == null)
    throw new InvalidOperationException();

   //写登录Cookie
   context.Response.Cookies.Remove(cookie.Name);
   context.Response.Cookies.Add(cookie);
  }
  /// <summary>
  /// 删除用户ticket票据
  /// </summary>
  public static void RemoveFormsAuthCookie() {
   FormsAuthentication.SignOut();
  }
 }