3

这是我的基本控制器的代码，其想法是如果授权字符串不在 HTTP 标头中，我们会将它们踢出。我发誓它工作正常，现在突然不工作了。奇怪的是，当我调试它实际上是进入 if 语句，所以我请求的 HTTP 标头确实是一个 NULL 或 EMPTY 字符串，但是，它不再提前退出并返回 403 Access Denied ......它正在工作很好，突然之间，当我尝试解析实际上未找到的授权字符串时，它只是忽略了整个事情并最终在应用程序中崩溃。

public class AuthController : Controller
    {
        protected int AccountID;

        protected override void OnAuthorization(AuthorizationContext filterContext)
        {
            //if no authorization string is provided, access denied
            if (string.IsNullOrEmpty(filterContext.HttpContext.Request.Headers["Authorization"]))
            {
                filterContext.Result = Content("Access Denied", "text/plain");
                filterContext.HttpContext.Response.StatusCode = 403; //forbidden


                base.OnAuthorization(filterContext);
            }

            //otherwise grab the authorization string and validate it
            string authString = filterContext.HttpContext.Request.Headers["Authorization"];
            string urlPath = string.IsNullOrEmpty(filterContext.HttpContext.Request.Path) ? "" : filterContext.HttpContext.Request.Path;
            int getAccountID = 0;

            //if authorization fails...
            if (!AuthCore.Authorize(authString, urlPath, ref getAccountID))
            {
                filterContext.Result = Content("Access Denied", "text/plain");
                filterContext.HttpContext.Response.StatusCode = 403; //forbidden

                base.OnAuthorization(filterContext);
            }

            //AccountID will never be zero at this point
            AccountID = getAccountID;

            //carry on with Controller Action, request is valid and AccountID is known
            base.OnAuthorization(filterContext);
        }

更新：刚试过 filterContext.Result = new HttpUnauthorizedResult(); 相反，结果相同。尝试解析未找到的标头字符串时，控制器操作继续并引发错误。

更新 2：添加了“return;” 在除最后一个之外的每个 base.OnAuthorization() 调用之后，现在当它失败时，我得到一个从 MVC 移动的 302，然后是一个 404，结果是该应用程序试图重定向到一个实际上并不实际的默认登录页面 URL存在......这是否足够好？也许，但我宁愿直接阻止它，而不是让一些不稳定的重定向发生作为阻止它们的方式，这对我来说并不安全。

4

2 回答 2

1

啊哈！

我调用了 base.OnAuthorization() 太多次了，显然它实际上并不是与线程的永久告别......不知道为什么我认为现在我考虑它......这是工作代码：

protected override void OnAuthorization(AuthorizationContext filterContext)
{
    int getAccountID = 0;

    //if no authorization string is provided, access denied
    if (string.IsNullOrEmpty(filterContext.HttpContext.Request.Headers["Authorization"]))
    {
        filterContext.Result = Content("Access Denied", "text/plain");
        filterContext.HttpContext.Response.StatusCode = 403; //forbidden
    }
    else
    {
        //otherwise grab the authorization string and validate it
        string authString = filterContext.HttpContext.Request.Headers["Authorization"];
        string urlPath = string.IsNullOrEmpty(filterContext.HttpContext.Request.Path) ? "" : filterContext.HttpContext.Request.Path;

        //if authorization fails...
        if (!AuthCore.Authorize(authString, urlPath, ref getAccountID))
        {
            filterContext.Result = Content("Access Denied", "text/plain");
            filterContext.HttpContext.Response.StatusCode = 403; //forbidden
        }
    }

    //AccountID will never be zero at this point
    AccountID = getAccountID;

    //carry on with Controller Action, request is valid and AccountID is known
    base.OnAuthorization(filterContext);
}
于 2011-07-26T19:19:55.440 回答
0

我认为您应该查看这篇文章： 保护您的 ASP.NET MVC 3 应用程序

于 2011-08-17T13:03:40.193 回答