ASP.NET MVC：是否可以查看请求是否来自哪里？
我不希望用户通过将 url 写入浏览器中的控制器来直接访问图像和媒体。
我正在使用 Autorhizationfilter 来检查用户是否已登录并且应该有权查看图像或媒体，但是有没有办法查看用户是否直接通过浏览器请求控制器或者请求是否嵌入到.cshtml 或 js 文件。
I don't want the users to directly access images and media by writing the url to the controller in the browser.
I'm using a Autorhizationfilter to check if the user is logged in and should have access to see the image or media, but is there a way to see if the user is requesting the controller directly via the browser or if the request is embedded in the .cshtml or js-files.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
对此没有办法获得安全保护。使用 HttpWebRequest 或类似方法时，Referer 很容易被伪造。如果您只是想保护您的图像不被不使用浏览器以外的其他任何东西的普通用户使用，那么 Referer 就可以发挥作用。
另一种方法是为图像生成一个只能使用一次的 ID。不要编写
< /code> 其中 sdlkjdsjlksdlk 是您在会话变量中映射到图像的 ID。使用
ImageResult从控制器返回图像并在返回图像后删除 ID。There are no way to get a safe protection for this. Referer easily be be faked when using
HttpWebRequestor similar methods. Referer would work if you just want to protect your images from regular users that doesn't use anything other than a browser.Another method would be to generate a id for the images which can only be used one time. Instead of writing
<img src="/path/to/image.png" />you write<img src="/controller/image/sdlkjdsjlksdlk" />wheresdlkjdsjlksdlkis a ID that you map to your image in a session variable. UseImageResultto return the image from your controller and delete the ID when the image have been returned.您也许可以在以下位置检查引荐来源：
Request.UrlReferrer不过，这不太可靠。
You might be able to check the referrer in
Request.UrlReferrerThis would not be very reliable, though.
您可以通过代码在运行时查看 StackTrace 来完成此操作，但这是一项成本高昂的操作，并且假设两个请求的执行路径有足够的差异来做出决定。
You might can do this by looking at the StackTrace at run-time through your code, but that's a costly operation and that assumes that the execution paths for both requests are divergent enough to make a determination.