加入收藏 | 设为首页 | 会员中心 | 我要投稿 李大同 (https://www.lidatong.com.cn/)- 科技、建站、经验、云计算、5G、大数据,站长网!
当前位置: 首页 > 编程开发 > asp.Net > 正文

asp.net-mvc – MVC3中的OutputCache和Authorize过滤器

发布时间:2020-12-16 06:58:46 所属栏目:asp.Net 来源:网络整理
导读:我正在阅读一本关于MVC2的书,并在OutputCache部分中说明: Warning In the earlier section “How Authorization Filters Interact with Output Caching,” I explained that [Authorize] has special behavior to ensure that unauthorized visitors can’t
我正在阅读一本关于MVC2的书,并在OutputCache部分中说明:

Warning In the earlier section “How Authorization Filters Interact
with Output Caching,” I explained that [Authorize] has special
behavior to ensure that unauthorized visitors can’t obtain sensitive
information just because it’s already cached. However,unless you
specifically prevent it,it’s still possible that cached output could
be delivered to a different authorized user than the one for whom it
was originally generated.
One way to prevent that would be to
implement your access control for a particular content item as an
authorization filter (derived from AuthorizeAttribute) instead of
simply enforcing authorization logic inline in an action method,
because AuthorizeAttribute knows how to avoid being bypassed by output
caching. Test carefully to ensure that authorization and output
caching are interacting in the way you expect.

这在MVC3中仍然如此吗?

如果是肯定的,有什么方法可以防止这种情况发生? (因为书中的解释太模糊了).

问候.

解决方法

我觉得是这样的.

使用OutPutCache缓存数据时,这些数据将全局缓存.只要用户被授权,用户就会获得缓存数据.

是的,我们为outputcache提供了“VaryByParam”选项,但它也为传递的每个不同参数创建了一个新的缓存.这意味着它仍然是全球性的.

因此,如果您想基于用户缓存不同的数据,那么outputcache可能不是正确的方法.如果数据是用户特定的,则会话是正确的选择.这是会议的生命

(编辑:李大同)

【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容!

    推荐文章
      热点阅读