asp頁面VB.NET中的授權問題

我正在嘗試對 asp.net 應用程式進行身份驗證，并且我的 web.config 設定為首先允許訪問登錄頁面，然后拒絕所有未經授權的用戶訪問。知道 asp 評估自上而下，我認為通過將我的允許陳述句放在頂部，它會在嘗試進行身份驗證時首先擊中那個，但事實并非如此。當我允許訪問所有頁面時，我可以讓應用程式按需要作業，然后拒絕我不想暴露的頁面。這行得通......但是它非常麻煩，因為它可以擴展并且添加了許多更多的頁面。

  <!--allow login access-->
  <location path="login.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>



  <!--deny access to everything else-->
  <system.web>
    <authorization>
      <deny users="?"/>
    </authorization>
  </system.web>

有什么幫助嗎？我知道一切都應該轉移到 MVC，但我必須盡快完成這個專案，而且學得不夠快。

uj5u.com熱心網友回復：

好吧，每個用于設定安全性的 web.config 檔案都必須在每個檔案夾中。

例如，您顯示了兩個 Web 組態檔 - 但它們在哪里是關鍵問題。

所以，如果你有一個基本的歡迎頁面或其他什么，那很好（在根目錄中）。

作為一般規則，您的根檔案夾不會（也不應該受到保護）。

然后您可能有一個帳戶檔案夾（這是您的登錄頁面所在的位置。

同樣，不能保護或限制該帳戶檔案夾，因為用戶將如何登錄您的站點？

因此，您需要/想要/必須保護一個頁面是非常罕見的。

然而，一個很好的例子是，如果您創建了一個默認站點，那么您將擁有：

因此，請注意我們是如何擁有 Accounts 檔案夾的。這有您的登錄頁面，您忘記密碼（可能）等。

那么，上面的檔案夾在上面的“帳戶”檔案夾中有一個網路配置。

但是，該檔案夾中有一個名為“manage.aspx”的頁面。該頁面允許用戶更改密碼。我們不希望未登錄的用戶點擊該頁面，除非他們已登錄。因此 Accounts 檔案夾的 Web 配置是這樣的：

<?xml version="1.0"?>
<configuration>

  <location path="Manage.aspx">
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
  </location>

</configuration>

因此，只有“管理”頁面才會拒絕“匿名”用戶。

但是，對于默認頁面和主根目錄，我們當然允許用戶點擊/查看該頁面。（此外，誰想弄亂具有大量設定的 HUGE MAIN web.config 頁面。

However, for the rest of your site, then each secured section and web pages should be placed in folders.

For example, I have some "admin" users or site manager users. So, I created a folder called SiteAdmin.

Like this:

As you can see, it has things like "messages" for daily or site message settings. So only site admin users can use those pages.

Hence, my web config is this:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.web>

    <authorization>
            <allow roles="SiteAdmin" />
        <deny users="*" />
        </authorization>
    </system.web>
</configuration>

So, ONLY those who are part of the Sitedmin group (role) can use those pages.

And if you look above, your can see a folder called Portal. This is for customers and say their projects. Looking at the security for Portal folder, this page:

In above we have a page called MyProjects. So ONLY customers logged in can go view their projects. So, we ONLY allow logged in users. And the web.config is this:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
      <authorization>
            <allow roles="Portal" />
            <deny users="*" />
        </authorization>
    </system.web>
</configuration>

So, you have to be a logged in user, but ALSO a member of "Portal".

So, really, the security is not complex, and we VERY rare ever have to apply security to a given or single aspx page, since we group the pages and site by folders.

So, I don't recommend you have anything in the "root" folder much - except say a landing page. As a result, you don't need or want to, or have to setup security for the main root folder.

But, for anything useful, and any pages that you want to be (and have) security, then they go into sub folders. It not clear if you going to use "roles" or just use the fact of being a logged in user. But, even in that case, move all pages that you want for logged in users to a sub folder. You could have "everything" into one folder, but I doubt that the main page, and very many pages are going to be in the root of the site anyway, are they?

So, the first site level? I would not secure it, but then again, you might only have some main page, and after that, any other "pages of value" will be placed in sub folders, and you can simple as noted secure any and all pages in each of those folders with a simple web.config like this:

 <deny users="?" />

So, above means no "anonymous" or no logged in users allowed.

So, there is going to be as a general rule very bare bones pages in your root. In fact, placing a whole bunch of pages in the root is much like placing every document you have in "My documents". You create sub folders to organize MyDocuments, and you should do the same for the web site.

I don't believe you can have more then one web.config in the same folder, but I can't see the need or reason anyway.

So, if you want your pages to be secured, it quite much a "given" and assumption that such pages will be moved out of and not be in the root of the web site. And once that is done, then one single simple web config file can be used with deny users="?" (you still will have a web.config file for EACH of the folders - but really not much of a big deal - cut and paste an existing one the the deny users="?" for each of those folders, and you are quite much done.

However, I would expect that even for logged in users, then you want further security, and as above shows, you want to have some "roles" for each user, and thus once again, you group by folders -- such as my site admin folder for setting up things like welcome message etc.

So, remove the pages you have in root if you don't really want much of any content to be viewed. If you secure the sub folders, and a non-logged in user attempts to hit one of those pages then the logon page in the Accounts folder will automatic trigger and be displayed.

So, your logon page should be in the Accounts folder - along with a few other pages such as forgot password, or change password.

So, in a nutshell, to manage security, you use sub folders, and for further management, you want to introduce "roles", and thus even logged on users can have different levels security.

Assuming you used the basic web site template to create your site, then all of your logon account pages would have been automatic created for you. And you should also get/have a menu bar (bootstrapp - nice!!), and thus have something like this:

so, just start using the basic template, and menu bar as per above. You can see that it even shows my logon on the right side.

And I show/hide the menu bar items based on the users "role". So, in theory you could hide ALL OF the menu bar items - delete them, and only have one, or even none in the menu bar show UNLESS they are logged in, and thus they will have to navigate to some secured page. In fact, when the user "logs" on? I re-direct the user to My Projects page.

So, after a user logs in you can send them wherever you want, or what amounts to a basic page for logged in users to see.

標籤：网 验证 表单认证

上一篇：Windows10自定義憑據提供程式

下一篇：既然它們已經消失了，如何實作與Dropbox等效的長壽命令牌（dropbox-sdk-js、Meteor、React）