asp.net-mvc – 使用WebForm的MVC HtmlHelper

这将创建一个称为AntiForgeryData的内部密封类的实例。

该实例被序列化为一个基于应用程序路径的64位编码版本的cookie“__requestVerificationToken_”。

相同的AntiForgeryData实例被序列化为隐藏的输入。

AntiForgeryData的唯一部分是使用RNGCryptoserviceProvider.GetBytes()

所有这一切都可能在WebForms页面中被欺骗，唯一的混乱是隐藏的类的序列化。不幸的是，关键的方法(GetAntiForgeryTokenAndSetCookiE)依赖于ViewContext.httpContext.request来获取cookie，而WebForm需要使用httpContext.Current.request。

更新

没有太多的测试和很多的代码，但我想我已经破解了一点反思。我使用反射的地方我已经离开了上面的等效线：

using System;
using System.Reflection;
using System.Web;
using System.Web.Mvc;

/// <sumMary>Utility to provide MVC anti forgery tokens in WebForms pages</sumMary>
public class WebFoRMANtiForgery
{
    /// <sumMary>Create an anti forgery token in a WebForms page</sumMary>
    /// <returns>The HTML input and sets the cookie</returns>
    public static String AntiForgeryToken()
    {
        String formValue = GetAntiForgeryTokenAndSetCookie();

        // String fieldName = AntiForgeryData.GetAntiForgeryTokenName(null);
        var mvCassembly = typeof(HtmlHelper).Assembly;
        var afdType = mvCassembly.GetType("System.Web.Mvc.AntiForgeryData");
        String fieldName = Convert.ToString(afdType.InvokeMember(
            "GetAntiForgeryTokenName",BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.InvokeMethod,null,new object[] { null }));

        TagBuilder builder = new TagBuilder("input");
        builder.Attributes["type"] = "hidden";
        builder.Attributes["name"] = fieldName;
        builder.Attributes["value"] = formValue;
        return builder.ToString(tagRenderMode.SelfClosing);
    }

    static String GetAntiForgeryTokenAndSetCookie()
    {
        var mvCassembly = typeof(HtmlHelper).Assembly;
        var afdType = mvCassembly.GetType("System.Web.Mvc.AntiForgeryData");

        // new AntiForgeryDataserializer();
        var serializerType = mvCassembly.GetType("System.Web.Mvc.AntiForgeryDataserializer");
        var serializerCtor = serializerType.GetConstructor(new Type[0]);
        object serializer = serializerCtor.Invoke(new object[0]); 

        // String cookiename = AntiForgeryData.GetAntiForgeryTokenName(httpContext.Current.request.ApplicationPath);
        String cookiename = Convert.ToString(afdType.InvokeMember(
            "GetAntiForgeryTokenName",new object[] { httpContext.Current.request.ApplicationPath }));

        // AntiForgeryData cookieToken;
        object cookieToken;
        httpCookie cookie = httpContext.Current.request.Cookies[cookiename];
        if (cookie != null)
        {
            // cookieToken = serializer.Deserialize(cookie.value);
            cookieToken = serializerType.InvokeMember("Deserialize",BindingFlags.InvokeMethod,serializer,new object[] { cookie.Value });
        }
        else
        {
            // cookieToken = AntiForgeryData.NewToken();
            cookieToken = afdType.InvokeMember(
                "NewToken",BindingFlags.Public | BindingFlags.Static | BindingFlags.InvokeMethod,new object[0]);

            // String cookieValue = serializer.serialize(cookieToken);
            String cookieValue = Convert.ToString(serializerType.InvokeMember("serialize",new object[] { cookieToken }));

            var newCookie = new httpCookie(cookiename,cookievalue) { httpOnly = true };

            httpContext.Current.Response.Cookies.Set(newCookiE);
        }

        // AntiForgeryData formToken = new AntiForgeryData(cookieToken)
        // {
        //     CreationDate = datetiR_785_11845@e.Now,//     Salt = salt
        // };
        var ctor = afdType.GetConstructor(new Type[] { afdType });
        object formToken = ctor.Invoke(new object[] { cookieToken });

        afdType.InvokeMember("CreationDate",BindingFlags.SetProperty,formToken,new object[] { datetiR_785_11845@e.Now });
        afdType.InvokeMember("Salt",new object[] { null });

        // String formValue = serializer.serialize(formToken);
        String formValue = Convert.ToString(serializerType.InvokeMember("serialize",new object[] { formToken }));
        return formValue;
    }
}

用法类似于MVC：

WebFoRMANtiForgery.AntiForgeryToken()

它创建与MVC方法相同的cookie和相同的HTML。

我没有用盐和域方法打扰，但它们相当容易添加。