ASP.NET MVC 检测开放重定向攻击方法

IsLocalUrl方法是ASP.NET MVC 3.0新加的登录路径验证方法

//System.Web.WebPages RequestExtensions class
        private bool IsLocalUrl(string url)
        {
            if (string.IsNullOrWhiteSpace(url))
            {
                return false;
            }
            Uri absoluteUri;
            if (Uri.TryCreate(url,UriKind.Absolute,out absoluteUri))
            {
                return string.Equals(this.Request.Url.Host,absoluteUri.Host,StringComparison.OrdinalIgnoreCase);
            }
            else
            {
                bool isLocal = !url.StartsWith("http:", StringComparison.OrdinalIgnoreCase)
                    && !url.StartsWith("https:", StringComparison.OrdinalIgnoreCase)
                    && Uri.IsWellFormedUriString(url, UriKind.Relative);
                return isLocal;
            }
        }

 

转载于:https://my.oschina.net/kongdf/blog/884859