重定向前检查 ReturnUrl 是否有效
我正在使用 ASP.NET 会员资格和表单身份验证，在重定向到 returnURL 之前我想验证它。对于那些不熟悉工作流程的人来说，基本上，如果您请求一个需要您进行身份验证的页面，您将被重定向到登录页面。在 URL 字符串中，您将看到一个名为 returnURL 的参数，例如 http://example.com/login.aspx?ReturnUrl=%2fprotected% 2fdefault.aspx
无论您是在重定向（例如 Response.Redirect(returnURL)）中使用它，还是通过 FormsAuthentication.RedirectFromLoginPage 方法间接使用它，它都会通过而不验证 returnURL。 FormsAuthentication.RedirectFromLoginPage 确实有一个安全检查，确保它不会离开域，但这仍然无法阻止有人输入足够的随机字符来导致错误。
我尝试使用 System.IO.File.Exists(Server.MapPath(returnURL)) 但给出足够多的非法字符会导致 Server.MapPath 出错。
注意：URLEncoding 不起作用，因为我们不是清理参数，而是清理主 URL。
对于验证或清理 returnURL 值还有其他建议吗？
I'm using ASP.NET Membership and Form Authentication and before redirecting to the returnURL I wanted to validate it. For those unfamiliar with the workflow, basically if you request a page that requires that you are authenticated, you are redirected to a login page. In the URL string you'll see a parameter called returnURL, e.g.
http://example.com/login.aspx?ReturnUrl=%2fprotected%2fdefault.aspx
Whether you use this in a redirect such as Response.Redirect(returnURL) or indirectly through the FormsAuthentication.RedirectFromLoginPage method, it passes without validating returnURL. FormsAuthentication.RedirectFromLoginPage does have a security check that it is isn't leaving the domain, but that still doesn't stop someone from putting enough random characters to cause an error.
I tried using System.IO.File.Exists(Server.MapPath(returnURL)) but given enough illegal characters it cause Server.MapPath to error.
Note: URLEncoding doesn't work because we are not cleaning a parameter, but the primary URL.
Any other suggestions for validating or cleaning the returnURL value?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这篇文章解释了 ReturnURL 的剖析
http:// blogs.msdn.com/vijaysk/archive/2008/01/24/anatomy-of-forms-authentication-return-url.aspx
正如您正确指出的那样，域已被检查，因此同时加密您的身份验证 cookie ，并确保使用 https 我认为阻止无效 ReturnURL 的唯一方法就是忽略它，并将所有登录重定向到站点的主页或顶层，让用户然后通过菜单导航回来。一个很好的例子是当您登录 hotmail 时。
This post explains the anatomy of the ReturnURL
http://blogs.msdn.com/vijaysk/archive/2008/01/24/anatomy-of-forms-authentication-return-url.aspx
As you rightly state, the domain is checked, so along with encrypting your authentication cookie, and ensuring you use https I think the only thing you can do to to stop an invalid ReturnURL is to just ignore it, and redirect all logins to the home page or top level of you site letting users then navigate back via the menu. A good example of this is when you log into hotmail.