如何在 ASP.NET MVC 中限制对 [HttpGet] ActionResult 的访问？
想象一下，我有一个像这样的 ActionResult：
[HttpGet]
public ActionResult Cities(string q)
{
//Return a list of cities that matches parameter
}
如何停止除我的网站之外的所有其他网站使用此功能，就好像它是他们自己的基于 REST 的小服务来获取匹配城市列表一样？检查推荐人是唯一的方法吗？或者还有什么更好的想法吗？
Imagine I have an ActionResult like this:
[HttpGet]
public ActionResult Cities(string q)
{
//Return a list of cities that matches parameter
}
How do I stop all other sites apart from mine using this as if it's their own little REST-based service for getting a list of matching cities? Is checking the referrer the only way to go? Or are there any better ideas?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果您只在自己的项目中使用 REST，为什么要使用 REST？
例如，在 global.asax 中创建一个方法。一切都可以到达它。
另外，你用它来 jquery/json 吗？
在这种情况下， [HttpPost] 和 $.post 可以帮助你。
why use REST if you only are using it inside your own project?
make a method out of it in global.asax for example. everything can reach it.
also, are you using this for jquery/json?
a [HttpPost] and $.post could help you out in this case.
你对此有多担心？如果有人足够坚定的话，推荐人就可以伪造。
您是否已经有某种形式的用户会话管理——如果有，请使用它，但如果来自另一个站点的访问者也登录到您的站点，它仍然不是万无一失的。
如果不是...通过在原始页面中设置一个 cookie 来实现等效的东西，该 cookie 必须在目标操作上存在（并且有效），且有效期很短。
How worried about it are you? The referrer can be faked if someone is determined enough.
Do you have some form of user session management already in place -- if so use that, though it still isn't bullet proof if the visitor from another site is also logged into yours.
IF not ... implement something equivalent by setting a cookie in the originating page with a short expiry that must be present (and valid) on the target action.
阻止其他站点访问此操作的唯一方法是使用某种身份验证机制。您可以使用使用 machineKey 加密的 cookie 来确保请求来自同一个域。为此，您需要有一个登录页面，该页面将发出身份验证 cookie。
The only way to prevent other sites from accessing this action is to use some sort of authentication mechanism. You could use a cookie which was encrypted with your machineKey to make sure that the request came from the same domain. For this to work you need to have a login page which will emit the authentication cookie.
您对 HttpGet 请求的想法有多依赖？如果它是 HttpPost，您可以使用 AntiForgeryToken 及其属性来确保它来自正确的页面，这基本上是使用 cookie 方法，但一切都很好地为您包装。
How tied to the idea of it being an HttpGet request are you? If it was an HttpPost you could use the AntiForgeryToken and its attribute to ensure that it came from the correct page, this is basically using the cookie method but all nicely wrapped up for you.