如何锁定 ASP.NET MVC 中的路径? [英] How to lock down paths in ASP.NET MVC?

问题描述

我第一次尝试使用 MVC 4，以查看与 MVC 3 相比有哪些更改/添加/等.

首先，我创建了一个空白的 MVC 4 Web 应用程序并从头开始构建.

我注意到的与 MVC 4 不同的第一件事是以下 web.config 设置对网页的可访问性没有影响:

<预><代码><配置><位置路径=""><system.web><授权><deny users="?"/></授权></system.web></位置>.....</配置>

回到 MVC 3，上面的授权设置将拒绝所有匿名用户访问站点内的任何内容.但是，如果我将相同的设置添加到 MVC4 Web.config 文件中，匿名者可以自由支配他/她选择的 URL.

我需要在 MVC 4 中做什么才能像在 MVC 3 中那样锁定所有路径?

解决方案

看一看 保护您的 ASP.NET MVC 4 应用程序和新的 AllowAnonymous 属性..><块引用>

您不能使用路由或 web.config 文件来保护您的 MVC 应用程序(任何版本).保护 MVC 应用程序的唯一受支持方法是应用 Authorize 属性...

引用

<块引用>

MVC 使用路由并且不会将 URL 映射到物理文件位置，如 WebForms、PHP 和传统 Web 服务器.因此，使用 web.config 肯定会在您的站点中打开安全漏洞.

如果未来有变化，产品团队会进行沟通，但对于现在无一例外.

示例:

从默认的 ASP.Net MVC 项目(互联网/内联网)开始.

编辑 web.config 添加:

<system.web><授权><deny users="*"></授权></system.web></位置>

运行项目，默认情况下您将使用 Default 路由 /Home/Index 并且您会看到内容，只需绕过 web.config 而不更改默认值模板.为什么?因为 ASP.Net 管道正在将请求的 URL 与 web.config 中指定的位置进行比较.但是，在管道中执行授权事件后，路由发生(默认路由或自定义路由)并允许访问所谓的受限区域.

此外，任何 MVC Redirect() 也将绕过与在授权管道事件之后再次进行路由相同的安全措施.

我认为没有人应该接受可以工作的安全性.第一次就做正确的事，不要偷懒，使用一些不是设计用于特定技术的东西.

I'm playing around with MVC 4 for the first time to check out what's been changed/added/etc compared to MVC 3.

To start off, I created a blank MVC 4 Web Application and started building from scratch.

One of the first things that I noticed that is different in MVC 4 is the fact that the following web.config settings have no affect on the accessibility of the web pages:

<configuration>
    <location path="">
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
    </location>
    .....
</configuration>

Back in MVC 3, the authorization settings above would deny all anonymous users from accessing any content within the site. However, if I add the same settings to an MVC4 Web.config file, an anonymous has free reign over an URL that s/he chooses.

What do I need to do in MVC 4 to lock-down all paths like I did in MVC 3?

解决方案

Take a look at Securing your ASP.NET MVC 4 App and the new AllowAnonymous Attribute.

You cannot use routing or web.config files to secure your MVC application (Any Version). The only supported way to secure your MVC application is to apply the Authorize attribute...

Quote

MVC uses routes and does not map URLs to physical file locations like WebForms, PHP and traditional web servers. Therefore using web.config will definitely open a security hole in your site.

The product team will have a communication if this changes in the future, but for now it is without exception the rule.

Examples:

Start with the default ASP.Net MVC project (internet/intranet).

Edit the web.config adding:

<location path="Home">
  <system.web>
    <authorization>
      <deny users="*">
    </authorization>
  </system.web>
</location>

Run the project, by default you will use the Default route /Home/Index and you see content, simply bypassing the web.config with no changes to the default template. Why? Because the ASP.Net pipeline is comparing the URL requested to the location specified in the web.config. However, after the Authorization Event has been executed in the pipeline the routing taking place (Default routing or custom routing) and allows access to the supposedly restricted area.

Additionally, any MVC Redirect() will also by-pass the same security measures as again the routing takes place after the Authorization Pipeline Event.

I don't think anyone should accept sorta working security. Do it correctly the first time, don't be lazy and use something that wasn't designed to be used with a specific technology.

这篇关于如何锁定 ASP.NET MVC 中的路径?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！