namespace Tiray.Security
{
public class OperationAuthorizationModule : IHttpModule
{
public void Dispose()
{
}
public String ModuleName
{
get { return "OperationAuthorizationModule"; }
}
public void Init(HttpApplication context)
{
context.PostAuthorizeRequest += new EventHandler(context_PostAuthorizeRequest);
context.EndRequest += new EventHandler(context_EndRequest);
}
private void ClearCookie()
{
HttpCookie clearCookie = new HttpCookie(Membership.ApplicationName + "_OpAuth", "");
clearCookie.Expires = DateTime.MinValue;
clearCookie.Value = string.Empty;
HttpContext.Current.Response.SetCookie(clearCookie);
}
private void ClearGuestCookie()
{
HttpCookie clearCookie = new HttpCookie(Membership.ApplicationName + "_OpAuth_Guest", "");
clearCookie.Expires = DateTime.MinValue;
clearCookie.Value = string.Empty;
HttpContext.Current.Response.SetCookie(clearCookie);
}
private Guid[] GetAuthorizationsFromDatabase(string userName)
{
Guid[] guids = null;
if (Utility.DataProvider.OpenConnection())
{
List<OperationAuthorizationAttribute> authorizations =
Utility.DataProvider.GetAuthorizationsForUser(Membership.ApplicationName, userName);
Utility.DataProvider.CloseConnection();
guids = new Guid[authorizations.Count];
int i = 0;
foreach (OperationAuthorizationAttribute authorization in authorizations)
{
guids[i] = authorization.ID;
i++;
}
}
return guids;
}
void context_PostAuthorizeRequest(object sender, EventArgs e)
{
HttpApplication application = (HttpApplication)sender;
//authenticated request
if (application.Request.IsAuthenticated)
{
OperationAuthorizationPrincipal principal = null;
Guid[] guids = null;
HttpCookie cookie = application.Request.Cookies[Membership.ApplicationName + "_OpAuth"];
//cookie is null,get authorizations from database
if (cookie == null || String.IsNullOrEmpty(cookie.Value))
{
guids = GetAuthorizationsFromDatabase(application.User.Identity.Name);
}
//cookie is valid,decrypt authorizations from cookie value
else
{
string userName;
guids = Utility.DecryptTicket(cookie.Value,out userName);
//current user is not the user who has authorized
//maybe a hacker try to use the cookie to attack our site
//we should clear the incorrect cookie,and get authorizations from database;
if (String.Compare(userName, application.User.Identity.Name, true) != 0)
{
ClearCookie();
ClearGuestCookie();
guids = GetAuthorizationsFromDatabase(application.User.Identity.Name);
}
}
principal = new OperationAuthorizationPrincipal(application.User, guids);
//Set principal to current context;
application.Context.User = principal;
Thread.CurrentPrincipal = principal;
}
}
void context_EndRequest(object sender, EventArgs e)
{
HttpApplication application = (HttpApplication)sender;
HttpCookie cookie = application.Request.Cookies[Membership.ApplicationName + "_OpAuth"];
HttpCookie guestCookie = application.Request.Cookies[Membership.ApplicationName + "_OpAuth_Guest"];
//authenticated request
if (application.Request.IsAuthenticated)
{
//cookie is invalid,build cookie from principal
if (cookie == null || String.IsNullOrEmpty(cookie.Value))
{
OperationAuthorizationPrincipal principal = application.User as OperationAuthorizationPrincipal;
if (principal != null)
{
//attention:dont't set cookie's expired time.
//we don't want to save cookie value on client's computer.
string ticket = Utility.EncryptTicket(principal.GetAuthorizations());
cookie = new HttpCookie(Membership.ApplicationName + "_OpAuth", ticket);
cookie.HttpOnly = true;
application.Response.SetCookie(cookie);
//we have set user's authorization cookie,clear the guest's one.
ClearGuestCookie();
}
}
}
//anonymous request
else
{
//cookie is invalid,build cookie from database
if (guestCookie == null || String.IsNullOrEmpty(guestCookie.Value))
{
Guid[] guids = GetAuthorizationsFromDatabase("guest");
//attention:dont't set cookie's expired time.
//we don't want to save cookie value on client's computer.
string ticket = Utility.EncryptTicket(guids);
cookie = new HttpCookie(Membership.ApplicationName + "_OpAuth_Guest", ticket);
cookie.HttpOnly = true;
application.Response.SetCookie(cookie);
//we have set guest's authorization cookie,clear the user's one.
ClearCookie();
}
}
}
}
}
订阅