Page_Load事件中的Response.Redirect

Question

If Response.Redirect("/") is called during Page_Load event, a malicious user could have access to the contents of the page (before the redirect), like the html itself? I'm trying to redirect unallowed users to default.aspx page, but I'm not sure if there are vulnerabilities using the code this way.

Answer 1

Place your page in a secure folder such as Members.

In that folder add the following web.config file.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

Now only authenticated users will be able to get to that page.

Answer 2

不用担心，只要将其放在活动开始就可以了。