文章詳情頁

在ASP.NET中創(chuàng)建安全的web站點(diǎn)

瀏覽：132日期：2022-08-02 17:00:39

以前用ASP,PHP,JSP編寫網(wǎng)站代碼的時(shí)候，站點(diǎn)安全性總是一件頭疼的事情，雖然我們編寫了用戶登錄，注冊，驗(yàn)證頁面，但是效果總是不理想。有時(shí)候我們不得不用大量的session變量來存放相關(guān)信息，處處設(shè)防。而在.NET環(huán)境下，這個(gè)問題處理起來就非常容易了。關(guān)鍵是要充分理解web.config文件。首先，介紹一下web.config文件。<?xml version="1.0" encoding="utf-8" ?><configuration><system.web><compilation defaultLanguage="vb" debug="true" /><customErrors mode="RemoteOnly" /><authentication mode="Windows" /> <authorization><allow users="*" /> </authorization><trace enabled="false" requestLimit="10" pageOutput="false" traceMode="SortByTime" localOnly="true" /><sessionState mode="InProc"stateConnectionString="tcpip=127.0.0.1:42424"sqlConnectionString="data source=127.0.0.1;user id=sa;password="cookieless="false" timeout="20" /><globalization requestEncoding="utf-8" responseEncoding="utf-8" /></system.web></configuration>好了，相信看過上面的介紹以后，對web.config文件一定非常了解了吧。下面我們就切入主題。為了防止用戶沒有經(jīng)過驗(yàn)證就訪問站點(diǎn)，我們的處理方法是當(dāng)用戶沒有通過驗(yàn)證的時(shí)候點(diǎn)擊任何頁面將會(huì)直接跳到Login.aspx頁面，具體代碼如下：<authentication mode="Forms"><forms name="yourAuthCookie" loginUrl="login.aspx"protection="All" path="/" /></authentication><authorization><deny users="?" /></authorization>但是這樣會(huì)產(chǎn)生一個(gè)問題，那就是如果我的站點(diǎn)有一些信息是可以讓任意用戶隨意訪問的，比如站點(diǎn)簡介，使用說明等。如果按照上面的處理方法豈不讓用戶覺得很麻煩，呵呵，不急，在ASP.NET中自然有相應(yīng)的解決辦法。下面的代碼可以實(shí)現(xiàn)匿名用戶訪問Test.aspx頁面：<location path="test.aspx"><system.web><authorization><allow users="?" /></authorization></system.web></location>解決了上面兩個(gè)問題，相信大家心里一定有底了吧。下面就開始實(shí)現(xiàn)login.aspx頁面。利用C#和SQL Server2000，創(chuàng)建一個(gè)webform頁面，加入相應(yīng)的控件。具體代碼如下：<%@ Page language="c#" Codebehind="login.aspx.cs"AutoEventWireup="false" Inherits="secure.login" %><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" ><HTML><HEAD><title>Secure Site</title><meta content="Microsoft Visual Studio 7.0" name="GENERATOR"><meta content="C#" name="CODE_LANGUAGE"><meta content="JavaScript" name="vs_defaultClientScript"><meta content="http://schemas.microsoft.com/intellisense/ie5"name="vs_targetSchema"></HEAD><body MS_POSITIONING="GridLayout"><form id="login" method="post" runat="server"><table cellSpacing="0" cellPadding="0" border="0"><tr><td vAlign="top" align="left"><asp:label id="Message" Runat="server" ForeColor="#ff0000"></asp:label></td></tr><tr><td vAlign="top" align="left"><b>E-mail:</b></td></tr><tr><td vAlign="top" align="left"><asp:textbox id="username" Runat="server" Width="120"></asp:textbox></td></tr><tr><td vAlign="top" align="left"><b>Password:</b></td></tr><tr><td vAlign="top" align="left"><asp:textbox id="password" Runat="server"Width="120" TextMode="Password"></asp:textbox></td></tr><tr><td vAlign="top" align="left"><asp:checkbox id="saveLogin" Runat="server"Text="<b>Save my login</b>"></asp:checkbox></td></tr><tr><td vAlign="top" align="right"><asp:imagebutton id="btnLogin" Runat="server"ImageUrl="/images/w2k/login/btnLogin.gif"></asp:imagebutton></td></tr></table></form></body></HTML>界面做好之后，就開始編寫提交按鈕事件，首先需要注冊該事件，代碼如下：private void InitializeComponent(){;;;;this.btnLogin.Click += new System.Web.UI.ImageClickEventHandler(this.btnLogin_Click);...}事件注冊好之后，自然就是編寫事件處理函數(shù)了：private void btnLogin_Click(object sender, System.Web.UI.ImageClickEventArgs e){CCommonDB sql = new CCommonDB();string redirect = "";if((redirect = sql.AuthenticateUser(this.Session, this.Response,username.Text, password.Text, saveLogin.Checked)) != string.Empty){// Redirect the userResponse.Redirect(redirect);}else{Message.Text = "Login Failed!";}}讀者看完上面的代碼之后一定想問CCommonDB是哪里來的東東，這是我編寫的一個(gè)類，用來處理用戶登錄信息的，如果成功則把相關(guān)信息寫入session、Cookie和SQL數(shù)據(jù)庫，同時(shí)跳到default.aspx頁面。具體如下：CCommonDB.csnamespace secure.Components{public class CCommonDB : CSql{public CCommonDB() : base() { }public string AuthenticateUser(System.Web.SessionState.HttpSessionState objSession, // Session VariableSystem.Web.HttpResponse objResponse,;// Response Variablestring email,// Loginstring password,;;;;;// Passwordbool bPersist// Persist login){int nLoginID;;= 0;int nLoginType;;= 0;// Log the user inLogin(email, password, ref nLoginID, ref nLoginType);if(nLoginID != 0);;// Success{// Log the user inSystem.Web.Security.FormsAuthentication.SetAuthCookie(nLoginID.ToString(), bPersist);// Set the session varaibles;;;;objSession["loginID"];;= nLoginID.ToString();objSession["loginType"] = nLoginType.ToString();// Set cookie information incase they made it persistantSystem.Web.HttpCookie wrapperCookie = new System.Web.HttpCookie("wrapper");wrapperCookie.Value = objSession["wrapper"].ToString();wrapperCookie.Expires = DateTime.Now.AddDays(30);System.Web.HttpCookie lgnTypeCookie = new System.Web.HttpCookie("loginType");lgnTypeCookie.Value = objSession["loginType"].ToString();lgnTypeCookie.Expires = DateTime.Now.AddDays(30);// Add the cookie to the responseobjResponse.Cookies.Add(wrapperCookie);objResponse.Cookies.Add(lgnTypeCookie);return "/candidate/default.aspx";}case 1:;;// Admin Login{return "/admin/default.aspx";}case 2:;;// Reporting Login{return "/reports/default.aspx";}default:{return string.Empty;}}}else{return string.Empty;}}/// <summary>/// Verifies the login and password that were given/// </summary>/// <param name="email">the login</param>/// <param name="password">the password</param>/// <param name="nLoginID">returns the login id</param>/// <param name="nLoginType">returns the login type</param>public void Login(string email, string password, ref int nLoginID, ref int nLoginType){ResetSql();DataSet ds = new DataSet();// Set our parametersSqlParameter paramLogin = new SqlParameter("@username", SqlDbType.VarChar, 100);paramLogin.Value = email;SqlParameter paramPassword = new SqlParameter("@password", SqlDbType.VarChar, 20);paramPassword.Value = password;Command.CommandType = CommandType.StoredProcedure;Command.CommandText = "glbl_Login";Command.Parameters.Add(paramLogin);Command.Parameters.Add(paramPassword);Adapter.TableMappings.Add("Table", "Login");Adapter.SelectCommand = Command;Adapter.Fill(ds);if(ds.Tables.Count != 0){DataRow row = ds.Tables[0].Rows[0];// Get the login id and the login typenLoginID;;= Convert.ToInt32(row["Login_ID"].ToString());nLoginType;;= Convert.ToInt32(row["Login_Type"].ToString());}else{nLoginID = 0;nLoginType = 0;}}}abstract public class CSql{private SqlConnection sqlConnection;;;;;;;// Connection stringprivate SqlCommand sqlCommand;;;// Commandprivate SqlDataAdapter sqlDataAdapter;;;;;;;// Data Adapter;;;;;;private DataSet sqlDataSet;;;;;// Data Setpublic CSql(){sqlConnection;;= new SqlConnection(ConfigurationSettings.AppSettings["ConnectionString"]);sqlCommand;;;;= new SqlCommand();sqlDataAdapter;;= new SqlDataAdapter();sqlDataSet;;;;= new DataSet();sqlCommand.Connection = sqlConnection;}/// <summary>/// Access to our sql command/// </summary>protected SqlCommand Command{get { return sqlCommand; }}/// <summary>/// Access to our data adapter/// </summary>protected SqlDataAdapter Adapter{get { return sqlDataAdapter; }}/// <summary>/// Makes sure that everything is clear and ready for a new query/// </summary>protected void ResetSql(){if(sqlCommand != null){sqlCommand = new SqlCommand();sqlCommand.Connection = sqlConnection;}if(sqlDataAdapter != null)sqlDataAdapter = new SqlDataAdapter();if(sqlDataSet != null)sqlDataSet = new DataSet();}/// <summary>/// Runs our command and returns the dataset/// </summary>/// <returns>the data set</returns>protected DataSet RunQuery(){sqlDataAdapter.SelectCommand = Command;sqlConnection.Open();sqlConnection.Close();sqlDataAdapter.Fill(sqlDataSet);return sqlDataSet;}}}

b站嗶哩嗶哩

上一條：騰訊送的美團(tuán)哪里去了下一條：豆瓣app怎么只看自己想看的豆瓣app只看樓主的方法

排行榜

					
					抖音LOVE手勢怎么拍
微信被騙了錢怎么追回來了？
微信步數(shù)如何刷
企業(yè)微信打卡定位怎么修改位置
花粉俱樂部登陸失敗是怎么回事
手機(jī)支付寶APP購買高鐵票的具體操作方法
抖音怎么知道自己是不是被封號了？被封號了怎么申訴恢復(fù)？
天貓精靈能聽QQ音樂嗎
釘釘直播時(shí)對方能聽到我說話嗎
SolidWorks投影曲線與基準(zhǔn)面鏡像畫圖
釘釘怎么查看直播時(shí)長和觀看人數(shù)？釘釘直播時(shí)長和觀看人數(shù)查看方法
				