隐藏查询字符串参数
我有一个用于创建记录的 GET 操作。由于该页面有些动态，因此我不使用模型来保存数据。我去做一些 OAuth，稍后又返回到创建屏幕。为了将数据传回，我使用查询字符串进行重定向。我在 GET 操作中解析查询字符串，然后显示视图。问题是，查询字符串显示在浏览器中。这会显示伪敏感数据。
由于我仅使用查询字符串来传输数据，因此我想知道是否可以丢弃查询字符串以防止它显示在浏览器上。
否则，有没有办法在不重定向的情况下转到另一个操作？我发现，如果我直接调用“其他”操作方法，它会尝试找到原始操作的视图。我可以显式地将 return View(viewModel) 行更改为 return View("create", viewModel) 但这看起来真的很脏。
I have a GET action for creating records. Because the page is somewhat dynamic, I don't use a model to hold the data. I go off to do some OAuth, only to return to the create screen later on. In order to pass the data back, I am redirecting with a query string. I parse the query string in the GET action, and then show the view. The thing is, the query string is showing up in the browser. This displays pseudo-sensitive data.
Since I am only using the query string for transferring data, I am wondering if I can throw the query string away to prevent it from showing up on the browser.
Otherwise, is there a way to go to another action without redirecting? I've found, if I call the "other" action method directly, it tries to find the view of the original action. I can explicitly change the return View(viewModel) line to return View("create", viewModel) but that seems really dirty.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您应该考虑更改操作以接受 POST 请求。至少这会阻止敏感信息出现在浏览器中。为了额外的安全性，您的网站应通过 SSL 提供服务。
您可以尝试的另一件事是加密敏感值或整个查询字符串。唯一的问题是，除非您要求用户登录，否则这也将保留在浏览器的历史记录中。
You should consider changing the action to accept POST requests. At least this will prevent the sensitive information from appearing in the browser. For extra security, your site should be served via SSL.
The other thing you can try is encrypting the sensitive values or the entire query string. The only problem is that this, too, will be preserved in the browser's history unless you require users to log in.
看来您的操作方法尝试做的事情太多了。身份验证/授权是一个单独的问题，不应成为操作方法的一部分。最好将身份验证工作移至操作过滤器中。
创建一个扩展授权属性的类并重写其 OnAuthorization 方法来完成授权工作。
这将释放您的控制器操作方法来接受 POST 请求。
It looks like your action method is trying to do too much. Authentication/authorization is a separate concern which should not be part of the action method. It is better to move the authentication work in to an action filter.
Create an class that extends authorization attribute and override its OnAuthorization method to do your authorization work.
This frees your controller action method to accept POST requests.