如何在ASP.NET网站中写入页面白名单

Question

I have a website and as one of security options (prevent path traversal) I am planning to use a white list of pages which can be accessed. But my problem is I don't know how to do it. Can you share some articles or simple of code how to create a white list?

Answer 1

如果我正确理解了这个问题，则希望允许某些用户访问您网站上的某些页面-您是否考虑过ASP.NET安全修整？

Answer 2

How many pages does the site have? If there are not too many pages and if pages are not added/removed frequently you can manually create a list of pages. If you are using master pages you can set this up in Page_Load method.

protected void Page_Load(object sender, EventArgs e)
    {
        if (!Page.IsPostBack)
        {
            Dictionary<string,string> allowedUrls = LoadAllowedURLs();

            if (!allowedUrls.ContainsKey(Request.Path))
            {
                Response.Redirect("Some_default_redirect_page.aspx");   
            }
        }

    }

Now, if you do have a lot of pages you would need more sophisticated solution that uses web.config and more…