在 asp.net 页面和弹出页面之间发送数据?

发布于 2024-07-10 17:49:12 字数 50 浏览 5 评论 0原文

asp.net 页面和弹出页面之间有哪些不同的通信方式? 查询字符串等。哪个最安全?

What are the different ways of communication between asp.net page and a popup page? Query strings etc. Which is most secure?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(5

请止步禁区 2024-07-17 17:49:12

您说的是弹出窗口和 ASP.NET 主页面之间的“通信”。 首先,我假设弹出窗口也是一个 ASP.NET 页面,因此从主页到弹出窗口的通信与一系列页面中的一个页面到下一个页面的通信没有什么不同。 也就是说,您可以通过查询字符串等在会话中存储然后使用数据(如果加载主页时数据可用)。除非数据敏感,否则迄今为止最简单的方法是将变量包含在对弹出窗口的调用被适当的参数替换。 以下是示例图像链接:

<img style='cursor:hand;' alt="Open Note" onclick="javascript:window.open('NoteEdit.aspx?T=3&UID=<%#NoteUID%>', 'Note', 'HEIGHT=400,WIDTH=420');" src="images/Note.gif" />

请注意“NoteUID”替换参数。

更有趣的问题是如何将信息传递回弹出的窗口。 为此,请从以下 javascript 开始:

<script type="text/javascript">
    function OpenHRAResults()
    {
        opener.location.href="<%#DestName%>";
        window.close();
    }
</script>

这是从我重新打开特定页面的代码中获取的,但是,正如您所猜测的,您可以使用“opener”窗口(弹出的窗口)执行各种操作。弹出窗口)。

希望这可以帮助...

You say "communication between" the pop-up and the main ASP.NET page. First, I assume that the pop-up is an ASP.NET page as well so the communication from the main page to the pop-up is no different from the communication from one page to the next in a series of pages. That is, you can store and then use data in the session (if the data is available when the main page is loaded), via query strings, etc. Unless the data is sensitive, the simplest way by far is to include a variable in the call to the pop-up that is replaced by the appropriate arguments. Here is a sample image link:

<img style='cursor:hand;' alt="Open Note" onclick="javascript:window.open('NoteEdit.aspx?T=3&UID=<%#NoteUID%>', 'Note', 'HEIGHT=400,WIDTH=420');" src="images/Note.gif" />

Note the "NoteUID" replacement argument.

The more interesting question is how to pass information back to the window that popped up the pop up. To do that, start with this javascript:

<script type="text/javascript">
    function OpenHRAResults()
    {
        opener.location.href="<%#DestName%>";
        window.close();
    }
</script>

This is taken from code where I re-open a specific page but, as you can guess, you can do all sorts of things with the "opener" window (the window that popped-up the pop up).

Hope this helps...

§对你不离不弃 2024-07-17 17:49:12

如果您正在谈论实际的弹出页面,则您正在使用 javascript 中的 window.open 。 您可以使用查询字符串和 Javascript 作为在它们之间传递信息的唯一真正可用的选项。

至于“安全”这个。 用户将能够通过查询字符串看到任何内容,JavaScript 可以移动值,但它们将存在于其他页面上。 但是您可以传递诸如加密值之类的东西来使事情变得更安全。

If you are talking about an actual pop-up page, where you are using window.open from javascript. You have the querystring and Javascript as your only real available options for passing information between.

As for "security" of this. The users will be able to see anything via a querystring, JavaScript can move values across, but they would be existing on the other page. But you could pass something like an excrypted value to make things more secure.

贱人配狗天长地久 2024-07-17 17:49:12

我们尽量避免查询字符串,有时它们太方便了。 在这些情况下,我们总是加密查询字符串。 有多种方法可以做到这一点 - 一种方法的示例:

http://www .codeproject.com/kb/web-security/querystringencryptionnet.aspx

We try to avoid query strings where possible in sometimes they are just too convenient. In those cases we always encrypt the querystring. There are several ways to do this - example of one approach:

http://www.codeproject.com/kb/web-security/querystringencryptionnet.aspx

羅雙樹 2024-07-17 17:49:12

一些方法

  • 查询字符串(window.open('/users/123'..)
  • Javascript(window.opener)
  • HTTP POST(通过javascript打开弹出窗口,将表单目标设置为其名称作为目标并发布)
  • 会话或其他服务器侧面方法

为了回答安全性考虑,我想说查询字符串与服务器端安全性相结合是打开通过查询字符串传递信息的弹出窗口,然后验证登录用户是否有权访问该用户的方法。一些特定的要求需要加密查询字符串数据,

我可能会使用回发来避免“我的索引蜘蛛删除了所有用户”之类的问题。

A few methods

  • Query strings (window.open('/users/123'..)
  • Javascript (window.opener)
  • HTTP POST (open a popup via javascript, set the form target to it's name as target and post)
  • Sessions or other server side methods

In answer to the security consideration I'd say that query strings in combination with server side security is the way to go. Open the popup passing the information via query strings, then validate that the logged in user has permissions to access that user. Some specific requirements would call for encrypting the querystring data.

For delete operations I'd probably use a postback to avoid problems like "my indexing spider deleted all users".

桃酥萝莉 2024-07-17 17:49:12

您不需要将真实数据发送到弹出窗口。 只需在打开页面上创建一个 GUID 即可。
在 asp.net 中创建一个类,它表示弹出页面和打开页面之间需要发送的所有数据。 例如弹出数据
将序列化的类存储在 Session 中,GUID 为名称 Session[Guid] = class object
会话[Guid] = popupdata;

使用 fi ~/popupwindow.aspx?PageID=Guid 打开弹出窗口
再次调用 Session[Guid] 来检索会话对象(Guid 来自 PageID 查询字符串。

因此在弹出页面上调用 popupdata data = (popupdata)Session[Guid];

然后对数据执行任何您喜欢的操作。

如果数据是在弹出窗口上更改,您可以再次将其存储在 Session 变量中
并将其发送回开启者...

非常安全,因为没有数据发送到客户端。

You don't need to sent the real data to the popup window. Just create a GUID on the opener page.
Create a class in asp.net which represent all the data you need to sent between the popup page and the opener page. For example popupdata
Store the serialized class in the Session with the GUID as the name Session[Guid] = class object
Session[Guid] = popupdata;

Open the popup with f.i. ~/popupwindow.aspx?PageID=Guid
Retrieve the session object with calling the Session[Guid] again (Guid is coming from the PageID querystring.

so on the popup page call popupdata data = (popupdata)Session[Guid];

And then do whatever yuo like withthe data.

If data is changed on the popupwindow you can store it in the Session variable again
and send it back to the opener...

Very secure since no data is sent to the client.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文