第二十三节：Asp.Net Core中的几种安全防护

 1 public class AdminSafeListMiddleware
 2     {
 3         private readonly RequestDelegate _next;
 4         private readonly string _adminSafeList;
 5         public AdminSafeListMiddleware(RequestDelegate next,string adminSafeList)
 6         {
 7             _adminSafeList = adminSafeList;
 8             _next = next;
 9         }
10         public async Task Invoke(HttpContext context)
11         {
12             //if (context.Request.Method != "GET")
13             {
14                 var remoteIp = context.Connection.RemoteIpAddress;    //获取远程访问IP
15                 string[] ip = _adminSafeList.Split(‘;‘);
16                 var bytes = remoteIp.GetAddressBytes();
17                 var badIp = true;
18                 foreach (var address in ip)
19                 {
20                     var testIp = IPAddress.Parse(address);
21                     if (testIp.GetAddressBytes().SequenceEqual(bytes))
22                     {
23                         badIp = false;
24                         break;    //直接跳出ForEach循环
25                     }
26                 }
27                 if (badIp)
28                 {
29                     context.Response.StatusCode = 401;
30                     return;
31                 }
32             }
33             await _next.Invoke(context);
34         }
35     }

 1     /// 

 2     /// IP校验过滤器
 3     /// 
 4     public class ClientIpCheckFilter: ActionFilterAttribute
 5     {
 6 
 7         private readonly string _safelist;
 8         public ClientIpCheckFilter(IConfiguration configuration)
 9         {
10             _safelist = configuration["IpSafeList"];
11         }
12         /// 

13         /// 方法执行前执行
14         /// 
15         /// 
16         public override void OnActionExecuting(ActionExecutingContext context)
17         {
18             var remoteIp = context.HttpContext.Connection.RemoteIpAddress;
19             string[] ip = _safelist.Split(‘;‘);
20             var badIp = true;
21             foreach (var address in ip)
22             {
23                 if (remoteIp.IsIPv4MappedToIPv6)
24                 {
25                     remoteIp = remoteIp.MapToIPv4();
26                 }
27                 var testIp = IPAddress.Parse(address);
28                 if (testIp.Equals(remoteIp))
29                 {
30                     badIp = false;
31                     break;
32                 }
33             }
34             if (badIp)
35             {
36                 context.Result = new StatusCodeResult(401);
37                 return;
38             }
39             base.OnActionExecuting(context);
40         }
41     }

 1         public void ConfigureServices(IServiceCollection services)
 2         {
 3             services.AddControllersWithViews(options =>
 4             {
 5                 //全局注册的时候,过滤器中的构造函数中的注入对象会自动注入（不需要多此一举进行传入： options.Filters.Add(new ClientIpCheckFilter(Configuration));）
 6                 //1. 操作过滤器
 7                 options.Filters.Add(typeof(ClientIpCheckFilter));
 8                 //2. 页面过滤器
 9                 //options.Filters.Add(new ClientIpCheckPageFilter(Configuration));
10             });
11         }

 1 
 2 3     "viewport" content="width=device-width" />
 4      5      6     34 
35 
36     我是登录页面
37     "j_login">点我登录
38 
39 

        /// 

        /// 登录接口
        /// 
        /// 
        /// 
        /// 
        public IActionResult CheckLogin(string userAccount, string pwd, string returnUrl)
        {
            //1. 执行登录校验逻辑
            //这里假设校验通过
            HttpContext.Session.SetString("userName", userAccount);

            //2. 判断returnUrl中是否有值,如果没有值表示是直接进入到登录页面的，如果有值表示从别的页面跳转过来的
            if (string.IsNullOrEmpty(returnUrl))
            {
                //表示是直接进入到的登录页，则跳转到主页
                return Json(new { status = "ok", data = "/Home/Index" });
            }
            else
            {
                if (Url.IsLocalUrl(returnUrl))
                {
                    //是本地地址，则跳转过去
                    return Json(new { status = "ok", data = returnUrl });
                }
                else
                {
                    //非本地地址(如：非法地址)，则跳转到主页
                    return Json(new { status = "ok", data = "/Home/Index" });
                }
            }
        }

 1      /// 

 2     /// 校验是否登录的过滤器
 3     /// 
 4     public class CheckLogin : ActionFilterAttribute
 5     {
 6         /// 

 7         /// 方法执行前执行
 8         /// 
 9         /// 
10         public override void OnActionExecuting(ActionExecutingContext context)
11         {
12 
13             var _session = context.HttpContext.Session;
14             //判断是否登录
15             var isLogin = _session.GetString("userName");
16             if (string.IsNullOrEmpty(isLogin))
17             {
18                 var request = context.HttpContext.Request;
19                 var returnUrl = request.Path.ToString();  //获取当前请求地址 
20                 //判断请求类型
21                 if (IsAjaxRequest(request))
22                 {
23                     //表示是ajax请求
24                     context.Result = new ContentResult { StatusCode = 401, Content = "您没有登录" };
25                     return;
26                 }
27                 else
28                 {
29                     //截断请求
30                     context.Result = new RedirectResult($"/Home/LoginIndex?returnUrl={returnUrl}");
31                     return;
32                 }
33             }
34         }
35 
36         /// 

37         /// 判断该请求是否是ajax请求
38         /// 
39         /// 
40         /// 
41         private bool IsAjaxRequest(HttpRequest request)
42         {
43             string header = request.Headers["X-Requested-With"];
44             return "XMLHttpRequest".Equals(header);
45         }
46     }

 1   public void TestCode()
 2         {
 3             string msg = "http://www.baidu.com";         
 4             //Url编码和解码
 5             var urlCode=  HttpUtility.UrlEncode(msg);
 6             var urlMsg = HttpUtility.UrlDecode(urlCode);
 7             //Html编码和解码
 8             var htmlCode = HttpUtility.HtmlEncode(msg);
 9             var htmlMsg = HttpUtility.HtmlDecode(htmlCode);
10             //JS编码和解码
11             var jsCode = HttpUtility.JavaScriptStringEncode(msg);
12         }