mirror of
https://gitee.com/dotnetchina/OpenAuth.Net.git
synced 2025-04-30 04:45:56 +08:00
拿掉地址栏Token，因为特别不安全。
小王，xxx系统的地址是多少。。。然后账号就泄露了 缺点是Token不能跨域。 OpenAuth.WebApi\Web.config 修改一个provider标签MySql.Data.MySqlClient 使用vs自带功能整理了一下格式。
This commit is contained in:
小色
parent
b96a5630f9
commit
ffb40b28c1
@ -32,16 +32,7 @@ namespace OpenAuth.App.SSO
|
||||
|
||||
//Token by QueryString
|
||||
var request = filterContext.HttpContext.Request;
|
||||
if (request.QueryString[Token] != null)
|
||||
{
|
||||
token = request.QueryString[Token];
|
||||
var cookie = new HttpCookie(Token, token)
|
||||
{
|
||||
Expires = DateTime.Now.AddDays(10)
|
||||
};
|
||||
filterContext.HttpContext.Response.Cookies.Add(cookie);
|
||||
}
|
||||
else if (request.Cookies[Token] != null) //从Cookie读取Token
|
||||
if (request.Cookies[Token] != null) //从Cookie读取Token
|
||||
{
|
||||
token = request.Cookies[Token].Value;
|
||||
}
|
||||
|
||||
@ -3,6 +3,7 @@ using System.Configuration;
|
||||
using System.Web.Mvc;
|
||||
using Infrastructure;
|
||||
using OpenAuth.App.SSO;
|
||||
using System.Web;
|
||||
|
||||
namespace OpenAuth.Mvc.Controllers
|
||||
{
|
||||
@ -24,9 +25,17 @@ namespace OpenAuth.Mvc.Controllers
|
||||
try
|
||||
{
|
||||
var result = AuthUtil.Login(_appKey, username, password);
|
||||
if (result.Code ==200)
|
||||
if (result.Code == 200)
|
||||
{
|
||||
resp.Result = "/home/index?Token=" + result.Token;
|
||||
|
||||
var cookie = new HttpCookie("Token", result.Token)
|
||||
{
|
||||
Expires = DateTime.Now.AddDays(10)
|
||||
};
|
||||
Response.Cookies.Add(cookie);
|
||||
resp.Result = "/home/index";
|
||||
///拿掉地址栏Token，因为特别不安全。
|
||||
///小王，xxx系统的地址是多少。。。然后账号就
|
||||
}
|
||||
else
|
||||
{
|
||||
@ -48,9 +57,19 @@ namespace OpenAuth.Mvc.Controllers
|
||||
{
|
||||
try
|
||||
{
|
||||
var result = AuthUtil.Login(_appKey, "System","123456");
|
||||
if (result.Code ==200)
|
||||
return Redirect("/home/index?Token=" + result.Token);
|
||||
var result = AuthUtil.Login(_appKey, "System", "123456");
|
||||
if (result.Code == 200)
|
||||
{
|
||||
|
||||
var cookie = new HttpCookie("Token", result.Token)
|
||||
{
|
||||
Expires = DateTime.Now.AddDays(10)
|
||||
};
|
||||
Response.Cookies.Add(cookie);
|
||||
return Redirect("/home/index");
|
||||
///拿掉地址栏Token，因为特别不安全。
|
||||
///小王，xxx系统的地址是多少。。。然后账号就
|
||||
}
|
||||
else
|
||||
{
|
||||
return RedirectToAction("Index", "Login");
|
||||
|
||||
@ -4,117 +4,118 @@
|
||||
http://go.microsoft.com/fwlink/?LinkId=301879
|
||||
-->
|
||||
<configuration>
|
||||
<configSections>
|
||||
<section name="autofac" type="Autofac.Configuration.SectionHandler, Autofac.Configuration" />
|
||||
<!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
|
||||
<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
|
||||
|
||||
<sectionGroup name="enyim.com">
|
||||
<section name="memcached" type="Enyim.Caching.Configuration.MemcachedClientSection, Enyim.Caching" />
|
||||
</sectionGroup>
|
||||
</configSections>
|
||||
|
||||
<connectionStrings>
|
||||
<!--MSSQL数据库-->
|
||||
<add name="OpenAuthDBContext" connectionString="Data Source=.;Initial Catalog=OpenAuthDB;Persist Security Info=True;User ID=sa;Password=000000;MultipleActiveResultSets=True" providerName="System.Data.SqlClient" />
|
||||
<configSections>
|
||||
<section name="autofac" type="Autofac.Configuration.SectionHandler, Autofac.Configuration" />
|
||||
<!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
|
||||
<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
|
||||
|
||||
<!--MySQL数据库-->
|
||||
<!--<add name="OpenAuthDBContext" connectionString="server=127.0.0.1;user id=root;persistsecurityinfo=True;database=openauthdb;password=root" providerName="MySql.Data.MySqlClient" />-->
|
||||
</connectionStrings>
|
||||
<sectionGroup name="enyim.com">
|
||||
<section name="memcached" type="Enyim.Caching.Configuration.MemcachedClientSection, Enyim.Caching" />
|
||||
</sectionGroup>
|
||||
</configSections>
|
||||
|
||||
<enyim.com>
|
||||
<memcached protocol="Binary">
|
||||
<servers>
|
||||
<add address="127.0.0.1" port="11211" />
|
||||
</servers>
|
||||
</memcached>
|
||||
</enyim.com>
|
||||
|
||||
<appSettings>
|
||||
<add key="webpages:Version" value="3.0.0.0" />
|
||||
<add key="webpages:Enabled" value="false" />
|
||||
<add key="ClientValidationEnabled" value="true" />
|
||||
<add key="UnobtrusiveJavaScriptEnabled" value="true" />
|
||||
<!--登录超时时间-->
|
||||
<add key="AUTH_COOKIE_TIMEOUT_IN_MINUTES" value="5" />
|
||||
</appSettings>
|
||||
<connectionStrings>
|
||||
<!--MSSQL数据库-->
|
||||
<add name="OpenAuthDBContext" connectionString="Data Source=.;Initial Catalog=OpenAuthDB;Persist Security Info=True;User ID=sa;Password=000000;MultipleActiveResultSets=True" providerName="System.Data.SqlClient" />
|
||||
|
||||
<system.web>
|
||||
<compilation debug="true" targetFramework="4.5" />
|
||||
<httpRuntime targetFramework="4.5" />
|
||||
</system.web>
|
||||
<system.webServer>
|
||||
<handlers>
|
||||
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
|
||||
<remove name="OPTIONSVerbHandler" />
|
||||
<remove name="TRACEVerbHandler" />
|
||||
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
|
||||
</handlers>
|
||||
</system.webServer>
|
||||
<runtime>
|
||||
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="Autofac" publicKeyToken="17863af14b0044da" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-3.5.0.0" newVersion="3.5.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Http.WebHost" publicKeyToken="31bf3856ad364e35" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
</assemblyBinding>
|
||||
</runtime>
|
||||
<system.codedom>
|
||||
<compilers>
|
||||
<compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:6 /nowarn:1659;1699;1701" />
|
||||
<compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:14 /nowarn:41008 /define:_MYTYPE=\"Web\" /optionInfer+" />
|
||||
</compilers>
|
||||
</system.codedom>
|
||||
<entityFramework>
|
||||
<defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework">
|
||||
<parameters>
|
||||
<parameter value="mssqllocaldb" />
|
||||
</parameters>
|
||||
</defaultConnectionFactory>
|
||||
<providers>
|
||||
<provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
|
||||
<provider invariantName="MySql.Data.MySqlClient" type="MySql.Data.MySqlClient.MySqlProviderServices, MySql.Data.Entity.EF6, Version=6.9.8.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d">
|
||||
</provider></providers>
|
||||
</entityFramework>
|
||||
<system.data>
|
||||
<DbProviderFactories>
|
||||
<remove invariant="MySql.Data.MySqlClient" />
|
||||
<add name="MySQL Data Provider" invariant="MySql.Data.MySqlClient" description=".Net Framework Data Provider for MySQL" type="MySql.Data.MySqlClient.MySqlClientFactory, MySql.Data, Version=6.9.8.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d" />
|
||||
</DbProviderFactories>
|
||||
</system.data></configuration>
|
||||
<!--MySQL数据库-->
|
||||
<!--<add name="OpenAuthDBContext" connectionString="server=127.0.0.1;user id=root;persistsecurityinfo=True;database=openauthdb;password=root" providerName="MySql.Data.MySqlClient" />-->
|
||||
</connectionStrings>
|
||||
|
||||
<enyim.com>
|
||||
<memcached protocol="Binary">
|
||||
<servers>
|
||||
<add address="127.0.0.1" port="11211" />
|
||||
</servers>
|
||||
</memcached>
|
||||
</enyim.com>
|
||||
|
||||
<appSettings>
|
||||
<add key="webpages:Version" value="3.0.0.0" />
|
||||
<add key="webpages:Enabled" value="false" />
|
||||
<add key="ClientValidationEnabled" value="true" />
|
||||
<add key="UnobtrusiveJavaScriptEnabled" value="true" />
|
||||
<!--登录超时时间-->
|
||||
<add key="AUTH_COOKIE_TIMEOUT_IN_MINUTES" value="5" />
|
||||
</appSettings>
|
||||
|
||||
<system.web>
|
||||
<compilation debug="true" targetFramework="4.5" />
|
||||
<httpRuntime targetFramework="4.5" />
|
||||
</system.web>
|
||||
<system.webServer>
|
||||
<handlers>
|
||||
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
|
||||
<remove name="OPTIONSVerbHandler" />
|
||||
<remove name="TRACEVerbHandler" />
|
||||
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
|
||||
</handlers>
|
||||
</system.webServer>
|
||||
<runtime>
|
||||
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="Autofac" publicKeyToken="17863af14b0044da" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-3.5.0.0" newVersion="3.5.0.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
<dependentAssembly>
|
||||
<assemblyIdentity name="System.Web.Http.WebHost" publicKeyToken="31bf3856ad364e35" culture="neutral" />
|
||||
<bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
|
||||
</dependentAssembly>
|
||||
</assemblyBinding>
|
||||
</runtime>
|
||||
<system.codedom>
|
||||
<compilers>
|
||||
<compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:6 /nowarn:1659;1699;1701" />
|
||||
<compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:14 /nowarn:41008 /define:_MYTYPE=\"Web\" /optionInfer+" />
|
||||
</compilers>
|
||||
</system.codedom>
|
||||
<entityFramework>
|
||||
<defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework">
|
||||
<parameters>
|
||||
<parameter value="mssqllocaldb" />
|
||||
</parameters>
|
||||
</defaultConnectionFactory>
|
||||
<providers>
|
||||
<provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
|
||||
<provider invariantName="MySql.Data.MySqlClient" type="MySql.Data.MySqlClient.MySqlProviderServices, MySql.Data.Entity.EF6, Version=6.9.8.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d" />
|
||||
</providers>
|
||||
</entityFramework>
|
||||
<system.data>
|
||||
<DbProviderFactories>
|
||||
<remove invariant="MySql.Data.MySqlClient" />
|
||||
<add name="MySQL Data Provider" invariant="MySql.Data.MySqlClient" description=".Net Framework Data Provider for MySQL" type="MySql.Data.MySqlClient.MySqlClientFactory, MySql.Data, Version=6.9.8.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d" />
|
||||
</DbProviderFactories>
|
||||
</system.data>
|
||||
</configuration>
|
||||
@ -1,6 +1,8 @@
|
||||
using System.Configuration;
|
||||
using System.Web.Mvc;
|
||||
using OpenAuth.App.SSO;
|
||||
using System.Web;
|
||||
using System;
|
||||
|
||||
namespace OpenAuth.WebTest.Controllers
|
||||
{
|
||||
@ -19,7 +21,17 @@ namespace OpenAuth.WebTest.Controllers
|
||||
{
|
||||
var result = AuthUtil.Login(_appKey, username, password);
|
||||
if (result.Code == 200)
|
||||
return Redirect("/home/index?Token=" + result.Token);
|
||||
{
|
||||
|
||||
var cookie = new HttpCookie("Token", result.Token)
|
||||
{
|
||||
Expires = DateTime.Now.AddDays(10)
|
||||
};
|
||||
Response.Cookies.Add(cookie);
|
||||
return Redirect("/home/index");
|
||||
///拿掉地址栏Token，因为特别不安全。
|
||||
///小王，xxx系统的地址是多少。。。然后账号就
|
||||
}
|
||||
else
|
||||
{
|
||||
return View(result);
|
||||
|
||||
Loading…
Reference in New Issue
Block a user