针对所有请求的自定义授权
我有一个ASP.NET 4.0网站，其中包含一个包含JPG，PNG，MP4，MP3等多媒体文件的子文件夹。
目前，任何具有文件完整链接的用户都可以无限制地访问多媒体文件。 我想查找当前登录的请求的用户，并且在从数据库检查他们的权限后允许/禁止他们访问请求的文件。
我试图实现一个自定义HttpModule为此目的，但我无法找到当前用户提出请求。 以下是我的代码：
public class CustomHttpModule : IHttpModule
{
private const string URL_TO_LOOK_FOR = "/MultiMediaFiles/";
public CustomHttpModule()
{ }
public void Init(HttpApplication app)
{
app.AuthenticateRequest += CustomAuthenticateRequest;
//app.EndRequest += CustomAuthenticateRequest;
}
void CustomAuthenticateRequest(object source, EventArgs e)
{
HttpApplication app = (HttpApplication)source;
HttpContext context = app.Context;
Uri url = context.Request.Url;
if (url.AbsolutePath.StartsWith(URL_TO_LOOK_FOR, StringComparison.OrdinalIgnoreCase))
{
var response = context.Response;
response.Clear();
response.Write("app.Context.User :");
if (context.User == null || context.User.Identity == null || context.User.Identity.Name == null)
{
response.Write("No user");
}
else
{
response.Write(context.User.Identity.Name);
}
response.End();
response.Flush();
response.Close();
}
}
public void Dispose()
{ }
}
我尝试附加到事件： BeginRequest ， AuthenticateRequest ， PostAuthenticateRequest ，甚至EndRequest ，但在每种情况下的context.User即使在我登录到我的网站后，用户始终为null 。
编辑：我使用FormsAuthentication和我的web.config包含：
<system.web>
<authentication mode="Forms">
<forms name="MyWebFORMAUTH" timeout="60"
loginUrl="~/web/logon/default.aspx" cookieless="UseCookies"
defaultUrl="~/web/logon/default.aspx"
slidingExpiration="true" />
</authentication>
</system.web>
<system.webServer>
<modules>
<add name="CustomHttpModule" type="CustomHttpModule"/>
</modules>
<system.webServer>
注意：我无法修改指向多媒体文件的链接。
请帮忙。
更新：
您还需要告诉ASP.NET您不希望为特定目录中的某些文件类型执行静态内容处理程序。
以下是web.config文件的更新版本：
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
<httpRuntime />
<authentication mode="Forms">
<forms name="MyWebFORMAUTH" timeout="60"
loginUrl="~/web/logon/default.aspx" cookieless="UseCookies"
defaultUrl="~/web/logon/default.aspx"
slidingExpiration="true" />
</authentication>
</system.web>
<system.webServer>
<modules>
<add name="CustomHttpModule" type="CustomHttpModule" />
</modules>
<defaultDocument>
<files>
<clear />
<add value="Default.aspx" />
</files>
</defaultDocument>
</system.webServer>
<location path="MultiMediaFiles">
<system.webServer>
<handlers>
<!-- This line tells ASP.NET to skip the processing of PNG files
by default static content handler. -->
<add name="SkipStaticPng" path="*.png" verb="GET"
type="System.Web.Handlers.TransferRequestHandler"
preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>
</location>
</configuration>
你的代码应该工作。 这是一个例子：
Default.aspx的：
<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="WebForm" %>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Test</title>
</head>
<body>
<form id="form1" runat="server">
<asp:Label ID="CurrentUserLabel" runat="server" />
<br />
<asp:Button ID="LoginButton" runat="server" OnClick="LoginButton_Click" Text="Login" />
</form>
</body>
</html>
Default.aspx.cs：
using System;
using System.Security.Principal;
using System.Web.Security;
public partial class WebForm : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
if (!IsPostBack)
PopulateCurrentUserName();
}
protected void LoginButton_Click(object sender, EventArgs e)
{
FormsAuthentication.SetAuthCookie("test_user", false);
Response.Redirect(Request.Url.AbsoluteUri);
}
private void PopulateCurrentUserName()
{
IPrincipal user = Request.RequestContext.HttpContext.User;
if (user != null && user.Identity != null && !String.IsNullOrEmpty(user.Identity.Name))
CurrentUserLabel.Text = user.Identity.Name;
else
CurrentUserLabel.Text = "(null)";
}
}
CustomHttpModule.cs：
using System;
using System.Web;
public class CustomHttpModule : IHttpModule
{
private const string URL_TO_LOOK_FOR = "/MultiMediaFiles/";
public CustomHttpModule()
{
}
public void Init(HttpApplication app)
{
app.AuthenticateRequest += CustomAuthenticateRequest;
}
void CustomAuthenticateRequest(object source, EventArgs e)
{
HttpApplication app = (HttpApplication)source;
HttpContext context = app.Context;
Uri url = context.Request.Url;
if (url.AbsolutePath.StartsWith(URL_TO_LOOK_FOR, StringComparison.OrdinalIgnoreCase))
{
var response = context.Response;
response.Clear();
response.Write("app.Context.User :");
if (context.User == null || context.User.Identity == null || context.User.Identity.Name == null)
{
response.Write("No user");
}
else
{
response.Write(context.User.Identity.Name);
}
response.End();
response.Flush();
response.Close();
}
}
public void Dispose()
{
}
}
web.config中：
<?xml version="1.0"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0"/>
<httpRuntime/>
<authentication mode="Forms">
<forms name="MyWebFORMAUTH" timeout="60"
loginUrl="~/web/logon/default.aspx" cookieless="UseCookies"
defaultUrl="~/web/logon/default.aspx"
slidingExpiration="true" />
</authentication>
</system.web>
<system.webServer>
<modules>
<add name="CustomHttpModule" type="CustomHttpModule"/>
</modules>
<defaultDocument>
<files>
<clear/>
<add value="Default.aspx"/>
</files>
</defaultDocument>
</system.webServer>
</configuration>
这里是测试场景：