asp.net the use of ashx to implement the picture Anti-Theft chain Code _ Practical Skills

Get/img.ashx?img=svn_work.gif http/1.1
Accept: */*
referer:http://www.svnhost.cn/
Accept-language:zh-cn
Ua-cpu:x86
Accept-encoding:gzip, deflate
user-agent:mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2. NET CLR 1.1.4322;. NET CLR 2.0.50727;. NET CLR 3.0.04506.648;. NET CLR 3.5.21022; CIBA)
Host:www.svnhost.cn
Connection:keep-alive
The packet represents the request yun_qi_img/404.aspx file. We can see that referer represents the previous page Request page address, which is the source of the file. Host represents the address of the current request.
Here's a hotlinking packet.
Get/img.ashx?img=svn_work.gif http/1.1
Accept: */*
referer:http://745.cc/
Accept-language:zh-cn
Ua-cpu:x86
Accept-encoding:gzip, deflate
user-agent:mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2. NET CLR 1.1.4322;. NET CLR 2.0.50727;. NET CLR 3.0.04506.648;. NET CLR 3.5.21022; CIBA)
Host:www.svnhost.cn
Connection:keep-alive
We can see that two of the above data, representing the same file: Http://www.corange.cn/Img.ashx?img=svn_work.gif request process, the difference here is Referer, which is to request the same file, but the source of the request is different. So we can judge whether it is hotlinking from the current server in the program. Understand the principle, the realization of anti-theft chain is very simple. Below the picture anti-theft chain to achieve a demo. Asp. NET to add a img.ashx file, and then the background code is as follows:

Copy Code code as follows:

Using System;
Using System.Collections;
Using System.Data;
Using System.Web;
Using System.Web.Services;
Using System.Web.Services.Protocols;
Namespace GetImage
{
<summary>
Summary description of $codebehindclassname $
</summary>
[WebService (Namespace = "http://tempuri.org/")]
[WebServiceBinding (ConformsTo = wsiprofiles.basicprofile1_1)]
public class Img:ihttphandler
{
public void ProcessRequest (HttpContext context)
{
Context. Response.ContentType = "Image/jpg";
if (context. Request.urlreferrer!= null && context. Request.UrlReferrer.Host.Equals (context. Request.Url.Host, Stringcomparison.invariantcultureignorecase))
Context. Response.WriteFile (context. Server.MapPath ("~/" + context.) Request.querystring["IMG"]);
Else
Context. Response.WriteFile (context. Server.MapPath ("~/logo.gif"));
}
public bool IsReusable
{
Get
{
return false;
}
}
}
}

Indicates that if the source is not empty and the source's server is consistent with the current server, it means normal access, not hotlinking. Normal access to the contents of the file.
Otherwise is hotlinking, return website logo.
You can even make a random return to the correct picture, randomly return the wrong picture, or return to the correct picture, timed to return the wrong picture.
Then is the use of pictures, then use the picture is not directly <input type= "image" src= "Svn_work.gif"/>, but <input type= "image" src= "/img.ashx?img=" Svn_work.gif "/&gt, that is, to read the picture through the img,ashx. Others hotlinking words to use the following code: <input type= "image" src= "Yun_qi_img/img.ashximg=svn_work.gif"/>.