50 lines
1.7 KiB
C#
50 lines
1.7 KiB
C#
using System;
|
||
using System.Collections.Generic;
|
||
using System.Linq;
|
||
using System.Web;
|
||
using System.Web.Http.Controllers;
|
||
|
||
/// <summary>
|
||
/// HttpReferrer https://zh.wikipedia.org/wiki/HTTP%E5%8F%83%E7%85%A7%E4%BD%8D%E5%9D%80
|
||
/// HTTP參照位址（referer，或HTTP referer）是HTTP表頭的一個欄位，用來表示從哪兒連結到目前的網頁，採用的格式是URL。換句話說，藉著HTTP參照位址，目前的網頁可以檢查訪客從哪裡而來，這也常被用來對付偽造的跨網站請求。
|
||
/// </summary>
|
||
public class HttpReferrerAttribute : System.Web.Http.AuthorizeAttribute
|
||
{
|
||
public string Url { get; set; }
|
||
|
||
public override void OnAuthorization(HttpActionContext actionContext)
|
||
{
|
||
base.OnAuthorization(actionContext);
|
||
}
|
||
|
||
protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
|
||
{
|
||
base.HandleUnauthorizedRequest(actionContext);
|
||
}
|
||
|
||
protected override bool IsAuthorized(HttpActionContext actionContext)
|
||
{
|
||
if (actionContext.Request.Headers.Referrer == null) return false;
|
||
|
||
try
|
||
{
|
||
string host = HttpContext.Current.Request.Url.AbsoluteUri.Replace(HttpContext.Current.Request.Url.PathAndQuery, "/");
|
||
string referrer = actionContext.Request.Headers.Referrer.AbsoluteUri.Replace(actionContext.Request.Headers.Referrer.AbsolutePath, "/");
|
||
|
||
if (string.IsNullOrEmpty(this.Url))
|
||
{
|
||
return host == referrer;
|
||
}
|
||
else
|
||
{
|
||
return actionContext.Request.Headers.Referrer.AbsoluteUri.IndexOf(host + Url) > -1;
|
||
}
|
||
}
|
||
catch
|
||
{
|
||
|
||
}
|
||
|
||
return false;
|
||
}
|
||
} |