仅针对多个页面的安全页面过滤器

security page filter for just many pages

提问人:amir parsa rezaie 提问时间:2/19/2023 最后编辑:Hamid Mohammadiamir parsa rezaie 更新时间:2/21/2023 访问量:53

问:

我在核心 Razor 页面中创建页面筛选器 asp.net 我希望它仅适用于管理区域内的那些处理程序

这是我的页面过滤器

namespace ServiceHost
{
    public class SecurityPageFilter :IPageFilter
    {
        private readonly IAuthHelper _authHelper;

        public SecurityPageFilter(IAuthHelper authHelper)
        {
            _authHelper = authHelper;
        }

        public void OnPageHandlerSelected(PageHandlerSelectedContext context)
        {

        }

        public void OnPageHandlerExecuting(PageHandlerExecutingContext context)
        {

            
            var handlerCompulsoryPermission = (NeedPermissionAttribute)context.HandlerMethod.MethodInfo.GetCustomAttribute(typeof(NeedPermissionAttribute));
            var accountPermissions = _authHelper.CurrentAccountPermissions();
            if (handlerCompulsoryPermission == null)
                return;
            if (!_authHelper.IsAuthenticated())
                context.HttpContext.Response.Redirect("/Account");


            if (!accountPermissions.Contains(handlerCompulsoryPermission.Permission))
                context.HttpContext.Response.Redirect("/Account");
        }

        public void OnPageHandlerExecuted(PageHandlerExecutedContext context)
        {
        }

    }
}

这是我的启动文件

namespace ServiceHost
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddHttpContextAccessor();

            var connectionString = Configuration.GetConnectionString("Keyson_Shop");
            ShopManagementBootstrapper.Configure(services, connectionString);
            DiscountManagementBootstrapper.Configure(services, connectionString);
            InventoryManagementBootstrapper.Configure(services, connectionString);
            BlogManagementBootstrapper.Configure(services, connectionString);
            CommentManagementBootstrapper.Configure(services, connectionString);
            AccountManagementBootstrapper.Configure(services, connectionString);

            services.AddTransient<IZarinPalFactory, ZarinPalFactory>();
            services.Configure<CookiePolicyOptions>(options =>
            {
                //this line does access to tempData work
                // options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.Lax;
            });

            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, o =>
                {
                    o.LoginPath = new PathString("/Account");
                    o.LogoutPath = new PathString("/Account");
                    o.AccessDeniedPath = new PathString("/AccessDenied");
                });

            services.AddCors(options => options.AddPolicy("MyPolicy", builder =>
                builder
                    .WithOrigins("https://localhost:5002")
                    .AllowAnyHeader()
                    .AllowAnyMethod()));

            services.AddRazorPages()
                .AddMvcOptions(options =>
                {
                    options.Filters.Add<SecurityPageFilter>();
                });



            services.AddTransient<IMenuQuery, MenuQuery>();
            services.AddTransient<IFileUploader, FileUploader>();
            services.AddSingleton<IPasswordHasher, PasswordHasher>();
            services.AddTransient<IAuthHelper, AuthHelper>();
           services.AddSingleton(HtmlEncoder.Create(UnicodeRanges.BasicLatin,UnicodeRanges.Arabic));
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseAuthentication();
            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseCookiePolicy();
            app.UseRouting();

            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapRazorPages();
                endpoints.MapDefaultControllerRoute();
            });
        }
    }
}

我想知道页面过滤器有任何选项可以提供它,并且只需在我的管理区域处理程序中运行。

但是,如果这没有选择,我需要对这个问题做些什么

如果回答这个问题,我会很高兴

C# asp.net 安全 Razor-Pages

评论


答: 暂无答案