Redirect to a page with endResponse to true VS CompleteRequest and security thread

后端 未结 2 2053
天涯浪人
天涯浪人 2020-11-28 15:30

Base on this questions and the answers there, I like to ask what is the proper way of redirecting.

The default way using the Redirect(url, endResponse) is throw the

2条回答
  •  南方客
    南方客 (楼主)
    2020-11-28 16:15

    It is not required to call Response.Redirect with true for endResponse to solve the security issue of outputting the page content after the redirect call. You can accomplish this another way and avoid causing a ThreadAbortException at the same time (which is always bad). Below are snippets of a page I created with 5 buttons that cause redirects in different ways, the RedirectRenderOverride button being the ideal as it is the one that triggers the Render method to do nothing. This has been tested with the NoRedirect add-in. Only two cases avoid outputting anything other than the 302 object moved response - RedirectEnd and RedirectRenderOverride.

    Code In Front

    
    
    
    
    
    

    Code Behind

    public partial class _Default : Page {
        private bool _isTerminating;
    
        protected void RedirectEnd(object sender, EventArgs e) { Response.Redirect("Redirected.aspx"); }
    
        protected void RedirectCompleteRequest(object sender, EventArgs e)
        {
            Response.Redirect("Redirected.aspx", false);
            HttpContext.Current.ApplicationInstance.CompleteRequest();
        }
    
        protected void RedirectClear(object sender, EventArgs e)
        {
            Response.Clear();
            Response.Redirect("Redirected.aspx", false);
        }
    
        protected void RedirectRenderOverride(object sender, EventArgs e)
        {
            Response.Redirect("Redirected.aspx", false);
            _isTerminating = true;
        }
    
        protected void RedirectEndInTryCatch(object sender, EventArgs e)
        {
            try {
                Response.Redirect("Redirected.aspx");
            } catch (ThreadAbortException) {
                // eat it
            } finally {
                Response.Write("Still doing stuff!");
            }
        }
    
        protected override void RaisePostBackEvent(IPostBackEventHandler sourceControl, string eventArgument)
        {
            if (!_isTerminating) {
                base.RaisePostBackEvent(sourceControl, eventArgument);
            }
        }
    
        protected override void Render(HtmlTextWriter writer)
        {
            if (!_isTerminating) {
                base.Render(writer);
            }
        }
    }
    

    Response.End calls Thread.CurrentThread.Abort internally and, according to Eric Lippert, calling Thread.Abort, "is at best indicative of bad design, possibly unreliable, and extremely dangerous."

提交回复
热议问题