在ASP.NET中創建安全的web站點

2024-07-10 13:13:14

字體：大中小

來源：轉載

供稿：網友

以前用ASP，PHP，JSP編寫網站代碼的時候，站點安全性總是一件頭疼的事情，雖然我們編寫了用戶登錄，注冊，驗證頁面，但是效果總是不理想。有時候我們不得不用大量的session變量來存放相關信息，處處設防。而在.NET環境下，這個問題處理起來就非常容易了。關鍵是要充分理解web.config文件。首先，介紹一下web.config文件。

<?xml version="1.0" encoding="utf-8" ?> <configuration>

<system.web>

<compilation defaultLanguage="vb" debug="true" /> <!-- 自定義錯誤信息設置 customErrors mode="On" 或 "RemoteOnly"

以啟用自定義錯誤信息，或設置為 "Off" 以禁用自定義錯誤信息。為每個要處理的錯誤添加 <error> 標記。 --> <customErrors mode="RemoteOnly" />  <authentication mode="Windows" />  <authorization> <allow users="*" />   </authorization>  <trace enabled="false" requestLimit="10" pageOutput="false"

traceMode="SortByTime" localOnly="true" />  <sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;user id=sa;password=" cookieless="false" timeout="20" />

<globalization requestEncoding="utf-8" responseEncoding="utf-8" /> </system.web> </configuration>

　　好了，相信看過上面的介紹以后，對web.config文件一定非常了解了吧。下面我們就切入主題。為了防止用戶沒有經過驗證就訪問站點，我們的處理方法是當用戶沒有通過驗證的時候點擊任何頁面將會直接跳到Login.aspx頁面，具體代碼如下：

　　但是這樣會產生一個問題，那就是如果我的站點有一些信息是可以讓任意用戶隨意訪問的，比如站點簡介，使用說明等。如果按照上面的處理方法豈不讓用戶覺得很麻煩，呵呵，不急，在ASP.NET中自然有相應的解決辦法。下面的代碼可以實現匿名用戶訪問Test.aspx頁面：

　　解決了上面兩個問題，相信大家心里一定有底了吧！下面就開始實現login.aspx頁面。利用C#和SQL Server2000，創建一個webform頁面，加入相應的控件。具體代碼如下：

<%@ Page language="c#" Codebehind="login.aspx.cs" AutoEventWireup="false" Inherits="secure.login" %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <HTML> <HEAD> <title>Secure Site</title> <meta content="Microsoft Visual Studio 7.0" name="GENERATOR"> <meta content="C#" name="CODE_LANGUAGE"> <meta content="javascript" name="vs_defaultClientScript"> <meta content="http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema"> </HEAD> <body MS_POSITIONING="GridLayout"> <form id="login" method="post" runat="server"> <table cellSpacing="0" cellPadding="0" border="0"> <tr> <td vAlign="top" align="left"> <asp:label id="Message" Runat="server" ForeColor="#ff0000"> </asp:label> </td> </tr> <tr> <td vAlign="top" align="left"> <b>E-mail:</b> </td> </tr> <tr> <td vAlign="top" align="left"> <asp:textbox id="username" Runat="server" Width="120"> </asp:textbox> </td> </tr> <tr> <td vAlign="top" align="left"> <b>Password:</b> </td> </tr> <tr> <td vAlign="top" align="left"> <asp:textbox id="password" Runat="server" Width="120" TextMode="Password"> </asp:textbox> </td> </tr> <tr> <td vAlign="top" align="left"> <asp:checkbox id="saveLogin" Runat="server" Text="<b>Save my login</b>"> </asp:checkbox> </td> </tr> <tr> <td vAlign="top" align="right"> <asp:imagebutton id="btnLogin" Runat="server" ImageUrl="/images/w2k/login/btnLogin.gif"> </asp:imagebutton> </td> </tr> </table> </form> </body> </HTML>

界面做好之后，就開始編寫提交按鈕事件，首先需要注冊該事件，代碼如下：

private void InitializeComponent() { this.btnLogin.Click += new System.Web.UI.ImageClickEventHandler(this.btnLogin_Click); . . . }

　　事件注冊好之后，自然就是編寫事件處理函數了：

private void btnLogin_Click(object sender, System.Web.UI.ImageClickEventArgs e) { CCommonDB sql = new CCommonDB(); string redirect = ""; if((redirect = sql.AuthenticateUser(this.Session, this.Response, username.Text, password.Text, saveLogin.Checked)) != string.Empty) { // Redirect the user Response.Redirect(redirect); } else { Message.Text = "Login Failed!"; } }

　　讀者看完上面的代碼之后一定想問CCommonDB是哪里來的東東，這是我編寫的一個類，用來處理用戶登錄信息的，如果成功則把相關信息寫入session、Cookie和SQL數據庫，同時跳到default.aspx頁面。具體如下：

CCommonDB.cs namespace secure.Components { public class CCommonDB : CSql { public CCommonDB() : base() { } public string AuthenticateUser( System.Web.SessionState.HttpSessionState objSession, // Session Variable System.Web.HttpResponse objResponse, // Response Variable string email, // Login string password, // Password bool bPersist // Persist login ) { int nLoginID = 0; int nLoginType = 0; // Log the user in Login(email, password, ref nLoginID, ref nLoginType); if(nLoginID != 0) // Success { // Log the user in System.Web.Security.FormsAuthentication.SetAuthCookie(nLoginID.ToString(),

bPersist); // Set the session varaibles objSession["loginID"] = nLoginID.ToString(); objSession["loginType"] = nLoginType.ToString(); // Set cookie information incase they made it persistant System.Web.HttpCookie wrapperCookie = new System.Web.HttpCookie("wrapper"); wrapperCookie.Value = objSession["wrapper"].ToString(); wrapperCookie.Expires = DateTime.Now.AddDays(30); System.Web.HttpCookie lgnTypeCookie = new System.Web.HttpCookie("loginType"); lgnTypeCookie.Value = objSession["loginType"].ToString(); lgnTypeCookie.Expires = DateTime.Now.AddDays(30); // Add the cookie to the response objResponse.Cookies.Add(wrapperCookie); objResponse.Cookies.Add(lgnTypeCookie); return "/candidate/default.aspx"; } case 1: // Admin Login { return "/admin/default.aspx"; } case 2: // Reporting Login { return "/reports/default.aspx"; } default: { return string.Empty; } } } else { return string.Empty; } } /// <summary> /// Verifies the login and password that were given /// </summary> /// <param name="email">the login</param> /// <param name="password">the password</param> /// <param name="nLoginID">returns the login id</param> /// <param name="nLoginType">returns the login type</param> public void Login(string email, string password, ref int nLoginID,

ref int nLoginType) { ResetSql(); DataSet ds = new DataSet(); // Set our parameters SqlParameter paramLogin = new SqlParameter("@username", SqlDbType.VarChar, 100); paramLogin.Value = email; SqlParameter paramPassword = new SqlParameter("@password", SqlDbType.VarChar, 20); paramPassword.Value = password; Command.CommandType = CommandType.StoredProcedure; Command.CommandText = "glbl_Login"; Command.Parameters.Add(paramLogin); Command.Parameters.Add(paramPassword); Adapter.TableMappings.Add("Table", "Login"); Adapter.SelectCommand = Command; Adapter.Fill(ds); if(ds.Tables.Count != 0) { DataRow row = ds.Tables[0].Rows[0]; // Get the login id and the login type nLoginID = Convert.ToInt32(row["Login_ID"].ToString()); nLoginType = Convert.ToInt32(row["Login_Type"].ToString()); } else { nLoginID = 0; nLoginType = 0; } } } abstract public class CSql { private SqlConnection sqlConnection; // Connection string private SqlCommand sqlCommand; // Command private SqlDataAdapter sqlDataAdapter; // Data Adapter private DataSet sqlDataSet; // Data Set

public CSql() { sqlConnection = new SqlConnection(ConfigurationSettings.AppSettings

["ConnectionString"]); sqlCommand = new SqlCommand(); sqlDataAdapter = new SqlDataAdapter(); sqlDataSet = new DataSet(); sqlCommand.Connection = sqlConnection; } /// <summary> /// Access to our sql command /// </summary> protected SqlCommand Command { get { return sqlCommand; } } /// <summary> /// Access to our data adapter /// </summary> protected SqlDataAdapter Adapter { get { return sqlDataAdapter; } } /// <summary> /// Makes sure that everything is clear and ready for a new query /// </summary> protected void ResetSql() { if(sqlCommand != null) { sqlCommand = new SqlCommand(); sqlCommand.Connection = sqlConnection; } if(sqlDataAdapter != null) sqlDataAdapter = new SqlDataAdapter(); if(sqlDataSet != null) sqlDataSet = new DataSet(); } /// <summary> /// Runs our command and returns the dataset /// </summary> /// <returns>the data set</returns> protected DataSet RunQuery() { sqlDataAdapter.SelectCommand = Command; sqlConnection.Open(); sqlConnection.Close(); sqlDataAdapter.Fill(sqlDataSet); return sqlDataSet; } } }

上一篇：ASP.NET中基類頁的設計和使用

下一篇：ASP.NET3.5的ListView