Cross-Site Page request verification method

I. initial ideas

Recently, for project reasons, we need to implement the function: website a calls a page on website B that requires user authentication.

In csdn got a lot of enthusiastic friends help: http://community.csdn.net/Expert/topic/4416/4416588.xml? Temp =. 2847711 express your sincere thanks. Thank you!

Due to restrictions: different websites may be placed on different servers. After some time, I finally used the methods in ASP. NET advanced security programming to transmit encrypted data through URLs.

The main process is as follows:

1. Web. config

<Authentication mode = "forms"/>
<Machinekey validationkey = "encrypt" decryptionkey = "4a31494c3b1559ad910643e15c26d1cf689a83b2a63e4aa7"
Validation = "sha1"/>

Make sure that the machinekey and form verification are the same in Web. config of websites A and B.

2. Encrypt (encryption) and decrypt (decryption)

# Region "decryption"
Public Function mydecrypt (byval STR as string) as string
Dim myticket as formsauthenticationticket
Myticket = formsauthentication. decrypt (STR)
Return myticket. Name
End Function
# End Region
# Region "encryption"
Public Function myencrypt (byval STR as string) as string
Dim myticket as new formsauthenticationticket (STR, false, 30)
Dim encryptedticket as string = formsauthentication. Encrypt (myticket)
Return encryptedticket
End Function
# End Region

In this way, the security issue of Cross-Site Page calls is basically realized.

Note: There are many ways to call the same page on the same website, such as http: // localhost/*** or http: // ip. However, the session uses the cookie mechanism, so you must ensure that the debugging and calling are consistent.

I have learned a lot from myself and hope that high people can criticize and correct me. Thank you.

2. Complete Methods

Keys used for user data encryption need to be protected. This also requires a key, which can be placed in the config file, or in the registry.

SSL must be used to encrypt the channel.

 

......... To be continued