ASP.NET MVC 3中网站/媒体内容的授权

Question

我试图在未登录时拒绝访问文件夹或资源(防止泄漏).在文件夹中,我有我的

Web.config :(/Media)

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <deny users="?"/>
      <allow users="*" />
    </authorization>
  </system.web>
</configuration>

我打电话的代码:

指数:

@Video.MediaPlayer(
    path: "~/Media/Tree Felling2.wmv",
    width: "600",
    height: "400",
    autoStart: false,
    playCount: 1,
    uiMode:  "full",
    stretchToFit: true,
    enableContextMenu: true,
    mute: false,
    volume: 75)

@Video.Flash(path: "~/Media/sample.swf",
             width: "80%",
             //height: "600",
             play: true,
             loop: false,
             menu:  true,
             bgColor: "red",
             quality: "medium",
             //scale: "showall",
             windowMode: "transparent")

注销时:不显示闪存.媒体播放器不会连接到媒体.(预期)

登录后:显示 flash.但媒体播放器仍然无法连接到媒体.

我哪里错了？..

Answer 1

不幸的是,这是Windows Media Player for FF的一个已知错误.它将在IE中工作.

这种方法不起作用的原因非常简单:插件不会随请求一起发送身份验证cookie,因此就好像您未经过身份验证一样.

实现此功能的唯一方法是将cookie值作为查询字符串参数附加到请求,然后在服务器上重新同步会话.

让我们付诸行动,好吗？

不幸的是我们不能使用@Video.MediaPlayer帮助器,因为它不允许你指定查询字符串参数,它只适用于物理文件(有点糟糕).所以:

<object classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6" height="400" width="600" >
    <param name="URL" value="@Url.Content("~/media/test.wmv?requireAuthSync=true&token=" + Url.Encode(Request.Cookies[FormsAuthentication.FormsCookieName].Value))" />
    <param name="autoStart" value="False" />
    <param name="uiMode" value="full" />
    <param name="stretchToFit" value="True" />
    <param name="volume" value="75" />
    <embed src="@Url.Content("~/media/test.wmv?requireAuthSync=true&token=" + Url.Encode(Request.Cookies[FormsAuthentication.FormsCookieName].Value))" width="600" height="400" type="application/x-mplayer2" autoStart="False" uiMode="full" stretchToFit="True" volume="75" />
</object>

在内部,Global.asax我们订阅该Application_BeginRequest方法并重新同步请求中的身份验证cookie:

protected void Application_BeginRequest()
{
    if (!string.IsNullOrEmpty(Context.Request["RequireAuthSync"]))
    {
        AuthCookieSync();
    }
}

private void AuthCookieSync()
{
    try
    {
        string authParamName = "token";
        string authCookieName = FormsAuthentication.FormsCookieName;

        if (!string.IsNullOrEmpty(Context.Request[authParamName]))
        {
            UpdateCookie(authCookieName, Context.Request.QueryString[authParamName]);
        }
    }
    catch { }
}

private void UpdateCookie(string cookieName, string cookieValue)
{
    var cookie = Context.Request.Cookies.Get(cookieName);
    if (cookie == null)
    {
        cookie = new HttpCookie(cookieName);
    }
    cookie.Value = cookieValue;
    Context.Request.Cookies.Set(cookie);
}

这就是它.对此工作的唯一要求是在IIS 7集成管道模式下运行,以便所有请求都通过ASP.NET,甚至是.wmv文件的请求,否则BeginRequest显然不会触发它们.

如果您正在使用某些旧版Web服务器(例如IIS 6.0)或以经典管道模式运行,并且不希望使用ASP.NET对所有请求进行通配符映射,则可以将所有媒体文件放在安全位置(例如as ~/App_Data)用户无法直接访问,然后通过用[Authorize]属性修饰的控制器操作提供它们:

[Authorize]
public ActionResult Media(string file)
{
    var appData = Server.MapPath("~/App_Data");
    var filename = Path.Combine(path, file);
    filename = Path.GetFullPath(filename);
    if (!filename.StartsWith(appData))
    {
        // prevent people from reading arbitrary files from your server
        throw new HttpException(403, "Forbidden");
    }
    return File(filename, "application/octet-stream");
}

然后:

<object classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6" height="400" width="600" >
    <param name="URL" value="@Url.Action("media", "home", new { requireAuthSync = true, token = Request.Cookies[FormsAuthentication.FormsCookieName].Value })" />
    <param name="autoStart" value="False" />
    <param name="uiMode" value="full" />
    <param name="stretchToFit" value="True" />
    <param name="volume" value="75" />
    <embed src="@Url.Action("media", "home", new { requireAuthSync = true, token = Request.Cookies[FormsAuthentication.FormsCookieName].Value })" width="600" height="400" type="application/x-mplayer2" autoStart="False" uiMode="full" stretchToFit="True" volume="75" />
</object>