jquery Ajax calls. NET general processing file security issues

Recently in the maintenance of a customer's points website, found such a problem, someone through. Ashx of the loopholes in our database to insert text messages to send data, resulting in a certain loss of our text message costs

The generic processing file is the file with the suffix . ashx.

General processing files We are mainly used to make asynchronous calls to the previous jquery Ajax , for example:

$.ajax ({

Sync:false,

DataType: "Text",

URL: ".. /handler/handlervphone.ashx ",

Data: {Txtphone:txtphonevalue},

Success:function (Result) {

},

Error:function (Result) {

Alert ("Verifying that the phone number is registered is faulty!") ");

}

});

$.ajax ({

Sync:false,

DataType: "Text",

URL: ".. /handler/handlersmsservice.ashx ",

Data: {txtphone:txtphonevalue, type: "Get", prtype:1},

Success:function (Result) {

},

Error:function (Result) {

Alert ("The Phone verification code sent an error!") ");

return false;

}

});

The above is to do mobile phone number SMS send, call SMS interface, into the database insert values

These can be called by others, others only need to add the domain name in front of these generic processing files, and then add parameters to the other program to access the

For example:

Http://www.xxx.com/Handler/HandlerVPhone.ashx?txtPhone=xxxxxxxxxxx

Http://www.xxx.com/Handler/HandlerSmsService.ashx?txtPhone=xxxxxxxxxxx&type=Get&prType=1

The solution:

. NET page background, through the GUID to generate a unique value, assigned to the session, the foreground general processing file parameter value to the background to do validation

session["Chkcode"] = Guid.NewGuid (). ToString ();

Hdnchkcode. Value = session["Chkcode"]. ToString ();

Foreground Ajax gives parameters

$.ajax ({

Sync:false,

DataType: "Text",

URL: ".. /handler/handlersmsservice.ashx ",

Data: {txtphone:txtphonevalue, type: "Get", Prtype:1, Chkcode:hdnchkcode},

Success:function (Result) {

},

Error:function (Result) {

Alert ("The Phone verification code sent an error!") ");

}

});

General processing of the contents of the file to make judgments:

if (context. session["Chkcode"]! = NULL

&& context. session["Chkcode"]. ToString () = = Context. request.querystring["Chkcode"])

{

}

Else

{

}

This will prevent others from invoking your generic processing file, inserting values into your database,

jquery Ajax calls. NET general processing file security issues