生成的链接上的 ASP.net 身份验证

Question

我们的一个 ASP Web 应用程序有一个按钮，它会生成一个指向表单的过期链接。我们注意到任何拥有上述链接的人都可以查看该表格。我正在研究一种在打开链接时检查最终用户是否获得授权的方法。在他们查看链接之前询问他们的用户名/密码。

我的生成链接的子：

Protected Sub ButtonLink_Click(sender As Object, e As EventArgs)

    Dim strSQL As String = ""
    Dim wapguid As String = ""
    Dim cmd As New SqlCommand

    wapguid = System.Guid.NewGuid().ToString("N")

    strSQL = "INSERT INTO [WapCustomerAccess] (wapid, wapguid, expires, generatedBy) values (@wapid, @wapguid, @expires, @generatedBy)"

    cmd.CommandType = CommandType.Text
    cmd.CommandText = strSQL

    cmd.Parameters.AddWithValue("@wapid", WAPID)
    cmd.Parameters.AddWithValue("@1", wapguid)
    cmd.Parameters.AddWithValue("@generatedBy", Session.Item("UserFullName"))
    cmd.Parameters.AddWithValue("@expires", Date.Now.AddDays(31).ToString)

    Dim strConnString As String = System.Configuration.ConfigurationManager.ConnectionStrings("cnnCFHSWAP").ConnectionString
    Dim con As New SqlConnection(strConnString)
    cmd.Connection = con

    Try
      con.Open()
      cmd.ExecuteNonQuery()
    Catch ex As Exception
    Response.Write(ex.Message & "<br />")
    Finally
      con.Close()
      con.Dispose()
    End Try

    Dim t As New TextBox()
    t.Text = "http://wap-test.cfhs.local/secure/waplink.aspx?SSL=true&hash=" & WAPID & "&guid=" & wapguid & "&expires=45&suid=05A2FF&salt=x00FF&enc=true"
    t.ID = "txtLink"
    t.Width = 800
    t.ReadOnly = True
    t.BackColor = Drawing.Color.SeaShell

    PanelLink.Visible = True
    PanelLink.Controls.AddAt(0, t)
    PanelLink.Controls.Add(New LiteralControl("<br />"))

End Sub

Answer 1

您需要在生成的链接中引用的应用程序中限制对waplink.aspx 的访问。根据该应用程序，您会找到合适的教程来设置身份验证/授权，例如 [1]。

[1]https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config