WSFederationAuthenticationModule.IsSignInResponse中的潜在危险Request.Form

Question

在我的MVC3站点中,我避免使用新的ValidateInput属性设置requestValidationMode ="2.0",但现在我正在尝试切换到WIF进行身份验证,当STS重定向回我的站点时,我得到了异常,因为WSFederationAuthenticationModule.IsSignInResponse正在调用Request.Form而不是Request.Unvalidated().Form...有没有办法处理这个没有请求VALalidationMode ="2.0"(我真的不想这样做).

这是堆栈跟踪,所以你可以看到我的意思.我的Controller的方法永远不会被调用.

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (wresult="<trust:RequestSecuri...").]
   System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +8755668
   System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection) +122
   System.Web.HttpRequest.get_Form() +114
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.IsSignInResponse(HttpRequest request) +21
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request, Boolean onPage) +121
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +78
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +148
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

Answer 1

处理此问题的正确方法是向HttpRuntime添加特定验证器,该验证器知道如何检测有效的安全令牌.

请查看此处的任何示例:http://claimsid.codeplex.com/releases/view/62929

以下是其中一个的摘录(示例#5是具体的,也是MVC应用程序):

namespace FShipping
{
    using System;
    using System.Web;
    using System.Web.Util;
    using Microsoft.IdentityModel.Protocols.WSFederation;

    public class WsFederationRequestValidator : RequestValidator
    {
        protected override bool IsValidRequestString(HttpContext context, string value, RequestValidationSource requestValidationSource, string collectionKey, out int validationFailureIndex)
        {
            validationFailureIndex = 0;
            if (requestValidationSource == RequestValidationSource.Form &&
                collectionKey.Equals(WSFederationConstants.Parameters.Result, StringComparison.Ordinal))
            {
                if (WSFederationMessage.CreateFromFormPost(context.Request) as SignInResponseMessage != null)
                {
                    return true;
                }
            }

            return base.IsValidRequestString(context, value, requestValidationSource, collectionKey, out validationFailureIndex);
        }
    }
}

这是配置:

<system.web> 
...   
   <httpRuntime requestValidationType="FShipping.WsFederationRequestValidator" />
</system.web>