如何在ASP.NET中保护AJAX请求？

Question

I am developing an application in which I am displaying products in a grid. In the grid there is a column which have a disable/enable icon and on click of that icon I am firing a request through AJAX to my page manageProduct.aspx for enabling/disabling that particular product.

In my ajax request I am passing productID as parameter, so the final ajax query is as

http://example.com/manageProduct.aspx?id=234

Now, if someone (professional hacker or web developer) can get this URL (which is easy to get from my javascript files), then he can make a script which will run as a loop and will disable all my products.

So, I want to know that is there any mechanism, technique or method using which if someone tries to execute that page directly then, it will return an error (a proper message "You're not authorized or something") else if the page is executed from the desired page, like where I am displaying product list, then it will ecxecute properly.

Basically I wnat to secure my AJAX requests, so taht no one can directly execute them.

In PHP:

In php my colleague secure this PHP pages by checking the refrer of the page. as below:

$back_link = $_SERVER['HTTP_REFERER'];

if ($back_link =='')
{
   echo 'You are not authorized to execute this page';
}
else
{
  //coding
}

Please tell me how to the same or any other different but secure techique in ASP.NET (C#), I am using jQUERY in my app for making ajax requests.

Thanks

Answer 1

Forget about using the referer - it is trivial to forge. There is no way to reliably tell if a request is being made directly or as a response to something else.

If you want to stop unauthorised people from having an effect on the system by requesting a URL, then you need something smarter then that to determine their authorisation level (probably a password system implemented with HTTP Basic Auth or Cookies).

Answer 2

无论你做什么，都不要依赖像'HTTP_REFERER'这样的http标头，因为它们很容易被欺骗。

Answer 3

You need to check in your service that your user is logged in. Writing a good secure login system isn't easy either but that is what you need to do, or use the built in "forms authentication".

Also, do not use sequential product id's, use uniqueidentifiers, you can still have an integer product id for display but for all other uses like the one you describe you will want to use the product uniqueidentifier/guid.