68

We have an existing application that was build on ASP.NET MVC 4 & Web API. The admin parts of the site use Simple Membership. I'm interested in upgrading the application to MVC 5 / Web API 2, to take advantage of some of the new features that have been added. But it looks like they might be incompatible.

Specifically, after installing the RC packages from NuGet into one of the projects in my solution, and updating the web.config information, the application starts dying during startup on the line that calls WebSecurity.InitializeDatabaseConnection(), with this exception:

[MethodAccessException: Attempt by security transparent method 'WebMatrix.WebData.PreApplicationStartCode.OnConnectionOpened(System.Object, WebMatrix.Data.ConnectionEventArgs)' to access security critical method 'System.Web.WebPages.HttpContextExtensions.RegisterForDispose(System.Web.HttpContextBase, System.IDisposable)' failed.]
   WebMatrix.WebData.PreApplicationStartCode.OnConnectionOpened(Object sender, ConnectionEventArgs e) +70
   WebMatrix.Data.Database.OnConnectionOpened() +70
   WebMatrix.Data.Database.EnsureConnectionOpen() +51
   WebMatrix.Data.Database.QueryValue(String commandText, Object[] args) +63
   WebMatrix.WebData.DatabaseWrapper.QueryValue(String commandText, Object[] parameters) +13
   WebMatrix.WebData.SimpleMembershipProvider.GetUserId(IDatabase db, String userTableName, String userNameColumn, String userIdColumn, String userName) +206
   WebMatrix.WebData.SimpleMembershipProvider.ValidateUserTable() +87

Other projects in the same solution using Simple Membership that I have not upgraded continue to work just fine.

Googling around for more information turns up lots of hits for that exception, of course, but nothing particular to WebMatrix.

FWIW: I know that Microsoft has introduced (yet another) membership and identity solution, but unless there's a way to use that with the existing Simple Membership tables, or a seamless migration path for all of our existing user data, that's not really an option for us.

UPDATE (11 Oct)

I just tried this again with a fresh checkout of the current trunk of our app. I'm using Visual Studio 2012, but otherwise followed the instructions from MS for upgrading an existing project. After updating to MVC 5 / Web API 2 / EF 6, the app started up an ran just fine.

There were no explicit trust requirements in the web.config to remove. I added the code from this question to Global.asax.cs, and it reports that the app is running with full trust (in IIS Express, just F5-ed from VS).

Re-adding the same call to InitializeDatabaseConnection(), it starts dying with the exact same exception.

SOLUTION (28 Oct)

Trying the solution in @Kevin's update from Friday, I found that it works. It was really strange to me that adding this apparently unrelated package would solve these security issues, and even more strange after I removed the package from my solution, and it kept working.

Taking a closer look at what was happening, I realized that the reason why this fixes the behavior is quite simple: the Microsoft.AspNet.WebHelpers package has two dependencies that were being added to my solution: Microsoft.AspNet.WebPages.Data and Microsoft.AspNet.WebPages.WebData. Microsoft has moved the WebMatrix classes into new packages.

So added the helpers package fixed the problem, not because of anything it was doing, but because it was causing updated versions of the broken assemblies to be added to my solution. The solution to the initial incompatibility, then, is to install these new packages when updating everything else from NuGet:

Install-Package Microsoft.AspNet.WebPages.WebData

UPDATE (13 May 2015)

It has been suggested to me that you may also need to manually install the second new package:

Install-Package Microsoft.AspNet.WebPages.Data

This should not be necessary, because this package is an explicit dependency of the first, and NuGet should be smart enough to install both. But if you get an error when building, or don't see NuGet add the dependency, it might help you.

4

5 回答 5

36

WebMatrix 与 MVC 5 兼容。

我所做的是采用一个空的 MVC 5 项目并使用SimpleSecurity将 WebMatrix SimpleMembershipProvider 合并到其中，这是一个将 SimpleMembership 与 MVC 应用程序分离的开源项目。到目前为止，我能够创建数据库、播种并登录和注销。我计划在此参考应用程序中添加其他功能，例如电子邮件确认和各种测试。完成后，我将在SimpleSecurity 项目中发布源代码

如果我不得不猜测，您的问题可能与升级过程有关。您采用什么过程将 MVC 4 项目升级到 MVC 5？ 你遵循这个过程吗？您使用的是什么版本的 WebMatrix 程序集？您使用的是什么版本的 Visual Studio？我正在使用 2.0.0.0 版的 WebMatrix 和 Visual Studio 2013 RC。

更新（2013 年 10 月 25 日）

我继续我的实验，将 SimpleMembership 添加到 MVC 5 项目中，并且在某个地方它打破了，我得到了与 @Sixten Otto 相同的结果。我没有在添加内容时进行增量测试，但我怀疑它可能是在我安装 Web API 程序集时发生的。创建新的 MVC 5 项目时，默认情况下不会安装它们。

我对该错误进行了更多研究，并遇到了标题为“尝试通过安全透明方法'WebMatrix.WebData.PreApplicationStartCode.Start()' ”的QA。这是一个旧的 QA，最初有人在将 MVC 3 应用程序升级到 MVC 4 时遇到同样的错误。但最近人们一直在添加关于升级到 MVC 5 的答案，其中一个答案对我有用。 我的解决方案是安装 NuGet 包Microsoft.AspNet.WebHelpers。 安装此软件包后一切正常。

我对迁移到新的 ASP.NET Identity 的研究的一个注释是，它们不使用相同的密码哈希，这会阻止将旧成员移动到 ASP.NET Identity 使用的数据库中。ASP.NET Identity 现在似乎在不断变化，所以也许他们会为此想出一个解决方案。

更新（2/16/14）

我错误地报告说密码的哈希算法在 SimpleMembership 和 ASP.NET Identity 中是不同的。我假设这是基于对散列密码的视觉检查，假设它只是字段中的散列密码。经过进一步研究，我发现 SimpleMembership 使用 System.Web.Helpers.Crypto 类对密码进行哈希处理，密码字段中存储的实际上是 256 位子密钥和盐。有了这些信息，我运行了一些测试来验证 ASP.NET Identity 是否可以验证由 SimpleMembership 生成的密码，并且它通过了。我试图找出 SimpleMembership 使用的哈希算法，以便我可以在 ASP.NET Identity 中插入密码哈希，这将允许我将数据从 SimpleMembership 网站迁移到使用 ASP.NET Identity 的网站。我将在本文中更详细地讨论密码哈希以及如何将数据从 SimpleMembership 迁移到 ASP.NET Identity。

于 2013-10-09T12:46:15.277 回答
30

如果您收到错误

尝试通过安全透明方法“WebMatrix.WebData.PreApplicationStartCode.Start()”访问安全关键方法“System.Web.WebPages.Razor.WebPageRazorHost.AddGlobalImport(System.String)”失败。

为了解决此问题，请使用 NuGet 包管理器安装此包。

Install-Package Microsoft.AspNet.WebHelpers

在那之后，你可能会得到另一个错误

无法加载 WebMatrix.Data 版本 3.0.0.0 程序集

要解决此问题，请使用 NuGet 包管理器安装此包。

Install-Package Microsoft.AspNet.WebPages.Data
于 2014-03-23T05:52:10.530 回答
3

上述答案直到最近的网页 3.2.3 才起作用。一个新问题出现在我面前。我目前的解决方法是升级到 .Net 4.5.3。我沮丧地想到了这一点。在升级到网页 3.2.3 后，此问题不仅会影响 MVC 5，还会影响核心 Webmatrix 项目。我认为这是一个框架问题，将通过新的 Microsoft 标识来解决。我的当前修复如下： 注意：请使用 Visual Studio 中的属性页向导将您的目标框架更改为 .Net Framework 4.5.3。它将更新您的 web.config

<compilation debug="true" targetFramework="4.5.3">
  <assemblies>
    <add assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
  </assemblies>
</compilation>

第 1 步：安装包 Microsoft.AspNet.WebHelpers

第 2 步：安装包 Microsoft.AspNet.WebPages.Data

第 3 步：[可选] 安装包 Owin

第 4 步：通过属性页对话框将 targetFramework 更改为 .Net 4.5.3

在此处输入图像描述

[可选] 您的 Web.Config 应如下所示

    <?xml version="1.0"?>

<configuration>
  <appSettings/>
  <connectionStrings>
    <add connectionString="Server=XTREMEGOSPEL;Database=portfolioDB;Trusted_Connection=True" name="portDB" providerName="System.Data.SqlClient"/>
  </connectionStrings>
  <!--
    For a description of web.config changes see http://go.microsoft.com/fwlink/?LinkId=235367.

    The following attributes can be set on the <httpRuntime> tag.
      <system.Web>
        <httpRuntime targetFramework="4.5" />
      </system.Web>
  -->
  <system.web>
    <compilation debug="true" targetFramework="4.5.3">
      <assemblies>
        <add assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
      </assemblies>
    </compilation>
    <httpRuntime targetFramework="4.5" maxRequestLength="2097151"/>
    <authentication mode="Forms">
      <forms timeout="1440"/>
    </authentication>
    <sessionState timeout="1440"/>
    <pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID"/>
  </system.web>
  <system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="4294967295"/>
      </requestFiltering>
    </security>
  </system.webServer>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35"/>
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/>
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35"/>
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/>
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>
于 2015-04-20T10:56:24.367 回答
3

我们目前正在编写一个迁移文档，用于从 Simple Membership 迁移到 ASP.NET Identity。请继续关注几周，直到我们推送此迁移文档。现在，您必须将您的简单成员模式映射到身份并更改您的应用程序代码以使用 OWIN 进行登录/登录

于 2013-10-10T17:59:41.077 回答
1

我遇到了同样的问题，不是在我的本地计算机上，而是在现场有这个问题。

我从 web config 中删除了下面的行，它现在正在工作。

<dependentAssembly>
   <assemblyIdentity name="System.Web.WebPages.Razor" publicKeyToken="31bf3856ad364e35" />
   <bindingRedirect oldVersion="0.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
</dependentAssembly>
于 2016-05-27T15:08:59.417 回答