[技术文献] 学会如何在 ASP.NET 中创建安全Web站点

aideidaijia

小网卡

Rank: 1

1^# 大中小发表于 2007-7-19 18:34 只看该作者

学会如何在 ASP.NET 中创建安全Web站点

以前用ASP,PHP,JSP编写网站代码的时候，站点安全性总是一件头疼的事情，虽然我们编写了用户登录，注册，验证页面，但是效果总是不理想。有时候我们不得不用大量的session变量来存放相关信息，处处设防。而在.NET环境下，这个问题处理起来就非常容易了。关键是要充分理解web.config文件。首先，介绍一下web.config文件。 s[v D|PzK
V VtAZj
<?xml version="1.0" encoding="utf-8" ?> <{l1e~
<configuration> W]JMxP#4
d7AWFR
<system.web> )j P>
|:4[y,J%O1
 *_B,6!],J
<compilation defaultLanguage="vb" debug="true" /> 8tmoj~7n
x/3qEr~
 |vDG|a-
<customErrors mode="RemoteOnly" /> Ba\JXRRp
vJ%#BD|
 Hv\s&Z!X.
<authentication mode="Windows" /> ]2BLMW61C
d62=%2vtf
T\0<"eMr
 zqwTNZt3j
<authorization> a0Z.tM+bA
<allow users="*" />  *X48$^{A
18_l h 2
 ]z<oxYvr
</authorization> -l7LSN+c
L+lk$+/p
 NQUH\ ?QT
<trace enabled="false" requestLimit="10" pageOutput="false" traceMode="SortByTime" localOnly="true" /> ,Du q/x\
&hy eAV
.5Rp8Mu
 QU;b3}bC
<sessionState (b>+ctr6My
mode="InProc" l NP
stateConnectionString="tcpip=127.0.0.1:42424" m() TYkHj
sqlConnectionString="data source=127.0.0.1;user id=sa;password=" xZK%N2!n3
cookieless="false" DGyZxwavf{
timeout="20" )6fwrN
/> mGuf(-K
af[V`\
 >t.KoTB[Wm
<globalization requestEncoding="utf-8" responseEncoding="utf-8" /> S#UT%k
c3e7w]n
</system.web> "' B]cs
2 T
</configuration> ^$a lB#
SF{G.G
好了，相信看过上面的介绍以后，对web.config文件一定非常了解了吧。下面我们就切入主题。为了防止用户没有经过验证就访问站点，我们的处理方法是当用户没有通过验证的时候点击任何页面将会直接跳到Login.aspx页面，具体代码如下： -&GcoN 9
$cKo94b*^
<authentication mode="Forms"> ,HH~ho$
<forms name="yourAuthCookie" loginUrl="login.aspx" j>D#h5 !
protection="All" path="/" /> f>#+hI
</authentication> `:\qBi
<authorization> OloCz A=
<deny users="?" /> Q-i@Z2
</authorization> . Yo-&'
但是这样会产生一个问题，那就是如果我的站点有一些信息是可以让任意用户随意访问的，比如站点简介，使用说明等。如果按照上面的处理方法岂不让用户觉得很麻烦，呵呵，不急，在ASP.NET中自然有相应的解决办法。下面的代码可以实现匿名用户访问Test.aspx页面： 9lLiM{
?-<a^BEX0
<location path="test.aspx"> a.Rj<3ru
<system.web> p,K&! |P
<authorization> 3[obo]ar
<allow users="?" /> Ab,o3pm
</authorization> ZLjI-"{O
</system.web> }_v~!>ov(
</location> !'$?u 2m>
y4i+ gB&P`
解决了上面两个问题，相信大家心里一定有底了吧。下面就开始实现login.aspx页面。利用C#和SQL Server2000，创建一个webform页面，加入相应的控件。具体代码如下： M|j"m8;6
]>d#gceOt
<%@ Page language="c#" Codebehind="login.aspx.cs" |%Yz +!
AutoEventWireup="false" Inherits="secure.login" %> NQ UZ| g
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > B[|gWOI
<HTML> ({t6A@7{
<HEAD> FitV5dAX
<title>Secure Site</title> &Z\C K+;
<meta content="Microsoft Visual Studio 7.0" name="GENERATOR"> pmpiL`Q}}
<meta content="C#" name="CODE_LANGUAGE"> _aH3V q
<meta content="Javas cript" name="vs_defaultClients cript"> UTzLR$r"3B
<meta content="http://schemas.microsoft.com/intellisense/ie5"; K'P*[HIY;
name="vs_targetSchema"> [3_La&'}
</HEAD> .Ia]v<uJ
<body MS_POSITIONING="GridLayout"> D9txi25A6
<form id="login" method="post" runat="server"> =5oss^
<table cellSpacing="0" cellPadding="0" border="0"> .bQ) "+
<tr> v jdNn'h:
<td vAlign="top" align="left"> Df&U6J8}
<asp:label id="Message" Runat="server" ForeColor="#ff0000"> U3]m#,1
</asp:label> Z Ja~@ci
</td> _-;e;
</tr> @W[>rTQ5,
<tr> 2>`SZc"^K*
<td vAlign="top" align="left"> oKK"HaqZ
<b>E-mail:</b> S}8{9 IXs
</td> GRO`U#
</tr> Pmr3+Z8Y
<tr> FM3|+?a%A
<td vAlign="top" align="left"> ))wLR[9
<asp:textbox id="username" Runat="server" Width="120"> ie!av:ql
</asp:textbox> ,30#(3e>W
</td> XS3D*{6\&
</tr> ^/aTB8Q
<tr> _< 5h=]T
<td vAlign="top" align="left"> | ~>+>
<b>Password:</b> ) bVuU?J
</td> <h ^/Wv
</tr> t~bL.\
<tr> uZX=5]i
<td vAlign="top" align="left"> ]p~8\5.=
<asp:textbox id="password" Runat="server" BY@3b<v
Width="120" TextMode="Password"> X7ty.5#4
</asp:textbox> >h\%9n!
</td> EHv#Q]enm
</tr> YWi&V~~f;
<tr> J;4iwmaE!
<td vAlign="top" align="left"> g]6_>
<asp:checkbox id="saveLogin" Runat="server" s/$(W<
Text="<b>Save my login</b>"> !;LyPrBnY
</asp:checkbox> n.5YZL
</td> r:&:00 *
</tr> @{Z,aR{;n
<tr> \zc:YT&
<td vAlign="top" align="right"> 0Frf>w|Z
<asp:imagebutton id="btnLogin" Runat="server" #..jSmYvE
ImageUrl="/images/w2k/login/btnLogin.gif"> SzU)"Xbs
</asp:imagebutton> F!W7N
</td> LUWxp"%y
</tr> r^PB!1_b
</table> 5c6_wcJ`KS
</form> phi Ou]$Y
</body> 7PFF>`
</HTML> 7R%*'FsU
r1mjaO $
"tX%bQ1Ff
界面做好之后，就开始编写提交按钮事件，首先需要注册该事件，代码如下： 1HK^}w|UW
<Q|g15Y
private void InitializeComponent() (q*s|6P@!
{ }nGk^_Q+7
this.btnLogin.Click += new System.Web.UI.ImageClickEventHandler(this.btnLogin_Click); 3M.IR;0Mp[
. GA#`T,k
. 'md'.x q
. 4^Il!s}
} ](v /&
事件注册好之后，自然就是编写事件处理函数了： MA?mcH_l
wrM_LAS^
private void btnLogin_Click(object sender, System.Web.UI.ImageClickEventArgs e) ` ~Csq
{ C{C~#UZx&
CCommonDB sql = new CCommonDB(); Gl>!!<-VE
string redirect = ""; L;+AFLV4J
K":HK]w
if((redirect = sql.AuthenticateUser(this.Session, this.Response, h-FqqS
username.Text, password.Text, saveLogin.Checked)) != string.Empty) ,+guyI V
{ !V >XgS{P
// Redirect the user LBu|SjaS
Response.Redirect(redirect); :0aKb9^hu
} ^r_u,f
else <ant=I j5
{ *>SL>
Message.Text = "Login Failed!"; 5%13o&CYy
} 0| e3~;D!
} kRIy@Mf(Fx
读者看完上面的代码之后一定想问CCommonDB是哪里来的东东，这是我编写的一个类，用来处理用户登录信息的，如果成功则把相关信息写入session、Cookie和SQL数据库，同时跳到default.aspx页面。具体如下： 1K.# "
Kg3"PrD.M
CCommonDB.cs o1`8m i0-+
u%}bg2E
namespace secure.Components $Kn'$#}IT
{ cHQv29zD
public class CCommonDB : CSql urwX ;
{ |['#wqlFQ[
public CCommonDB() : base() { } 6-h%n )vzX
p ]Ek $G[
public string AuthenticateUser( & LT-}
System.Web.SessionState.HttpSessionState objSession, // Session Variable #v^%yZj
System.Web.HttpResponse objResponse, // Response Variable LF=,rlb\.
string email, // Login Qprl @l
string password, // Password "ouK [5k
bool bPersist // Persist login (~L)Aok
) )[s_
{ ?l&SB^%ag
int nLoginID = 0; 691sOE
int nLoginType = 0; Q5hwBV
E|H{?E\M$
// Log the user in oe?sw u'X
Login(email, password, ref nLoginID, ref nLoginType); #56M TK[
O][s^Oi%K
if(nLoginID != 0) // Success J&W(Y N
{ U4[@:q'
// Log the user in Cv_\yJc
System.Web.Security.FormsAuthentication.SetAuthCookie(nLoginID.ToString(), bPersist); pPLOCBh
<rZKmts
// Set the session varaibles ox$/4]@]
objSession["loginID"] = nLoginID.ToString(); :VA|duMy^
objSession["loginType"] = nLoginType.ToString(); VL'p'YA}
\: ':w
// Set cookie information incase they made it persistant a-w[J@g|6
System.Web.HttpCookie wrapperCookie = new System.Web.HttpCookie("wrapper"); :^xh( e
wrapperCookie.Value = objSession["wrapper"].ToString(); L7" z93X
wrapperCookie.Expires = DateTime.Now.AddDays(30); Hlc]v2
2lYqjl:=
System.Web.HttpCookie lgnTypeCookie = new System.Web.HttpCookie("loginType"); f5gdhk
lgnTypeCookie.Value = objSession["loginType"].ToString(); K>&eSx
lgnTypeCookie.Expires = DateTime.Now.AddDays(30); .ah\#[@5
x@8&!f#
// Add the cookie to the response z#RbXPFd
objResponse.Cookies.Add(wrapperCookie); U?QH jw a
objResponse.Cookies.Add(lgnTypeCookie); zf#v5=$
KvkD;
return "/candidate/default.aspx"; hzi |!Z
} |a_Vs
case 1: // Admin Login )(%~\FW,K
{ il6r($%
return "/admin/default.aspx"; KhCOq]} ;
} gOd=O9vy
case 2: // Reporting Login l2P5F='q
{ L!((xNqLe
return "/reports/default.aspx"; }&gR.k.$g
} Zv *3xv
default: YyXw804F
{ fX(Uxl
return string.Empty; ?~bdH&M
} IvhI)B")n,
} 2T'&6=
} }!) 8T!)
else MB6<]O$G4
{ Q Su)Zu
return string.Empty; SXa%h eUH8
} Vj1F[wyKe
} X:/fXcfP0s
E [)(7OZ
/// <summary> s]v6?'' A
/// Verifies the login and password that were given c @ !
/// </summary> COC?@E 1<
/// <param name="email">the login</param> Tb= < \E
/// <param name="password">the password</param> ^O{W $
/// <param name="nLoginID">returns the login id</param> |i/|8~-t
/// <param name="nLoginType">returns the login type</param> ~"#X4U
public void Login(string email, string password, ref int nLoginID, ref int nLoginType) P:i+NL
{ O=ye/_9!;*
ResetSql(); __AqJRm
7~y* ruI)
DataSet ds = new DataSet(); Y}5/21"
<$196g1q
// Set our parameters sd[SlI5l@
SqlParameter paramLogin = new SqlParameter("@username", SqlDbType.VarChar, 100); ,31 $I^E
paramLogin.Value = email; 4}8gAc3Gj
y R:N
SqlParameter paramPassword = new SqlParameter("@password", SqlDbType.VarChar, 20); :bqIoMqX
paramPassword.Value = password; I!6~BHY45
G':A|zB
S\0ubM!&S
Command.CommandType = CommandType.StoredProcedure; MC~Au}
Command.CommandText = "glbl_Login"; ;6"RIL 4
Command.Parameters.Add(paramLogin); }=5q<,M<a7
Command.Parameters.Add(paramPassword); ;sDm/~?K
&@V$Ed|Lt
Adapter.TableMappings.Add("Table", "Login"); ;+Xw"\
Adapter.SelectCommand = Command; P?B=^c_G
Adapter.Fill(ds); {[wfgC^h
2`J:R^Kj
if(ds.Tables.Count != 0) .Q+)cAjq;
{ 7EU/"
DataRow row = ds.Tables[0].Rows[0]; %C1D{}zP^
Aw%#~D|U
// Get the login id and the login type h0^ KRc
nLoginID = Convert.ToInt32(row["Login_ID"].ToString()); X|-&c!
nLoginType = Convert.ToInt32(row["Login_Type"].ToString()); )QKR?uv9
} nNb~K57}4
else GUZ /@
{ _Z2u[l
nLoginID = 0; qjBBBRs
nLoginType = 0; ^7{<A-L^a
} BnqS.==
} hyf:;^
} GD' ,eVU[
,:o/X@N
abstract public class CSql T[ yHyV
{ 7[&Yb _a
private SqlConnection sqlConnection; // Connection string &xp I'qk
private SqlCommand sqlCommand; // Command jRn- zZ
private SqlDataAdapter sqlDataAdapter; // Data Adapter dini}J Fv
private DataSet sqlDataSet; // Data Set ^^T XjV$
}2qy3L
public CSql() Dq3la#UZ
{ o~.zG`Aa
sqlConnection = new SqlConnection(ConfigurationSettings.AppSettings["ConnectionString"]); :b}:yus%
sqlCommand = new SqlCommand(); 'r)uC8 A
sqlDataAdapter = new SqlDataAdapter(); e%}%1@T
sqlDataSet = new DataSet(); ^y+kc-il
JF/yP.N=k
sqlCommand.Connection = sqlConnection; ;Vi1N6nx
} Wm4^ek1 d
JutG|1UF0
/// <summary> :oVKa5)K
/// Access to our sql command VAR<3
/// </summary> & XtdTH
protected SqlCommand Command ?C"='YJZ
{ ?"KeA5&H
get { return sqlCommand; } 3Ub0tEm
} :uHO]u
jF"7S ^}
/// <summary> (Wc0'
/// Access to our data adapter I^LEOr>?@
/// </summary> hro>LB?w
protected SqlDataAdapter Adapter Ndb}rkkrw
{ 4i@hm{0
get { return sqlDataAdapter; } 2|t~ ER
} 7DO-b!"$
oE=,j",
/// <summary> B4>a?*oO
/// Makes sure that everything is clear and ready for a new query ~L]c}bI
/// </summary> O%(l]L|
protected void ResetSql() Dpl BU,5g
{ aN!xZg?
if(sqlCommand != null) 2Z@:XAU-p
{ OE>.{K} =
sqlCommand = new SqlCommand(); xZBJ/jv
sqlCommand.Connection = sqlConnection; 1Vs~$5?Wz
} Rg%y_Jm0\l
if(sqlDataAdapter != null) r >9gr7`29
sqlDataAdapter = new SqlDataAdapter(); }_*ab Ynk
-26+ aI
if(sqlDataSet != null) i@pkr+
sqlDataSet = new DataSet(); _+r{~b2
} G^<ZM+F^~
dYVX@OS\
/// <summary> KVnu j~#
/// Runs our command and returns the dataset 8J+e+/!u$
/// </summary> |\&ic%+Zq
/// <returns>the data set</returns> 5OiV 9M
protected DataSet RunQuery() 3*m "ic
{ }LIAFc9Dg
sqlDataAdapter.SelectCommand = Command; d<l,]vzW
#As3&*=x
sqlConnection.Open(); ;RU4 [z
sqlConnection.Close(); +y p>-@z*W
(o*zf 8 "q
sqlDataAdapter.Fill(sqlDataSet); 8/!rPr`0
G.kG Dt{*
return sqlDataSet; U@V)5!M x
} -P5Vsgx
} !SnaQB^
}

TOP

‹‹ 上一主题 | 下一主题 ››