FormsAuthentication.Decrypt(String) Method 在.net內部的呼叫
阿新 • • 發佈：2020-07-17
被System.Web.Security.FormsAuthenticationModule中的私有方法ExtractTicketFromCookie呼叫
// System.Web.Security.FormsAuthenticationModule // Token: 0x06004BFC RID: 19452 RVA: 0x001033AC File Offset: 0x001015AC private static FormsAuthenticationTicket ExtractTicketFromCookie(HttpContext context, string name, out bool cookielessTicket) { FormsAuthenticationTicket formsAuthenticationTicket= null; string text = null; bool flag = false; bool flag2 = false; FormsAuthenticationTicket result; try { try { cookielessTicket = CookielessHelperClass.UseCookieless(context, false, FormsAuthentication.CookieMode); if (cookielessTicket) { text= context.CookielessHelper.GetCookieValue('F'); } else { HttpCookie httpCookie = context.Request.Cookies[name]; if (httpCookie != null) { text = httpCookie.Value; } }if (text != null && text.Length > 1) { try { formsAuthenticationTicket = FormsAuthentication.Decrypt(text); } catch { if (cookielessTicket) { context.CookielessHelper.SetCookieValue('F', null); } else { context.Request.Cookies.Remove(name); } flag2 = true; } if (formsAuthenticationTicket == null) { flag2 = true; } if (formsAuthenticationTicket != null && !formsAuthenticationTicket.Expired && (cookielessTicket || !FormsAuthentication.RequireSSL || context.Request.IsSecureConnection)) { return formsAuthenticationTicket; } if (formsAuthenticationTicket != null && formsAuthenticationTicket.Expired) { flag = true; } formsAuthenticationTicket = null; if (cookielessTicket) { context.CookielessHelper.SetCookieValue('F', null); } else { context.Request.Cookies.Remove(name); } } if (FormsAuthentication.EnableCrossAppRedirects) { text = context.Request.QueryString[name]; if (text != null && text.Length > 1) { if (!cookielessTicket && FormsAuthentication.CookieMode == HttpCookieMode.AutoDetect) { cookielessTicket = CookielessHelperClass.UseCookieless(context, true, FormsAuthentication.CookieMode); } try { formsAuthenticationTicket = FormsAuthentication.Decrypt(text); } catch { flag2 = true; } if (formsAuthenticationTicket == null) { flag2 = true; } } if (formsAuthenticationTicket == null || formsAuthenticationTicket.Expired) { text = context.Request.Form[name]; if (text != null && text.Length > 1) { if (!cookielessTicket && FormsAuthentication.CookieMode == HttpCookieMode.AutoDetect) { cookielessTicket = CookielessHelperClass.UseCookieless(context, true, FormsAuthentication.CookieMode); } try { formsAuthenticationTicket = FormsAuthentication.Decrypt(text); } catch { flag2 = true; } if (formsAuthenticationTicket == null) { flag2 = true; } } } } if (formsAuthenticationTicket == null || formsAuthenticationTicket.Expired) { if (formsAuthenticationTicket != null && formsAuthenticationTicket.Expired) { flag = true; } result = null; } else { if (FormsAuthentication.RequireSSL && !context.Request.IsSecureConnection) { throw new HttpException(SR.GetString("Connection_not_secure_creating_secure_cookie")); } if (cookielessTicket) { if (formsAuthenticationTicket.CookiePath != "/") { FormsAuthenticationTicket formsAuthenticationTicket2 = FormsAuthenticationTicket.FromUtc(formsAuthenticationTicket.Version, formsAuthenticationTicket.Name, formsAuthenticationTicket.IssueDateUtc, formsAuthenticationTicket.ExpirationUtc, formsAuthenticationTicket.IsPersistent, formsAuthenticationTicket.UserData, "/"); formsAuthenticationTicket = formsAuthenticationTicket2; text = FormsAuthentication.Encrypt(formsAuthenticationTicket); } context.CookielessHelper.SetCookieValue('F', text); string url = FormsAuthentication.RemoveQueryStringVariableFromUrl(context.Request.RawUrl, name); context.Response.Redirect(url); } else { HttpCookie httpCookie2 = new HttpCookie(name, text); httpCookie2.HttpOnly = true; httpCookie2.Path = formsAuthenticationTicket.CookiePath; if (formsAuthenticationTicket.IsPersistent) { httpCookie2.Expires = formsAuthenticationTicket.Expiration; } httpCookie2.Secure = FormsAuthentication.RequireSSL; if (FormsAuthentication.CookieDomain != null) { httpCookie2.Domain = FormsAuthentication.CookieDomain; } httpCookie2.SameSite = FormsAuthentication.CookieSameSite; context.Response.Cookies.Remove(httpCookie2.Name); context.Response.Cookies.Add(httpCookie2); } result = formsAuthenticationTicket; } } finally { if (flag2) { WebBaseEvent.RaiseSystemEvent(null, 4005, 50201); } else if (flag) { WebBaseEvent.RaiseSystemEvent(null, 4005, 50202); } } } catch { throw; } return result; }
// System.Web.Security.FormsAuthenticationModule // Token: 0x06004BF9 RID: 19449 RVA: 0x00102F4C File Offset: 0x0010114C private void OnAuthenticate(FormsAuthenticationEventArgs e) { HttpCookie httpCookie = null; if (this._eventHandler != null) { this._eventHandler(this, e); } if (e.Context.User != null) { return; } if (e.User != null) { e.Context.SetPrincipalNoDemand(e.User); return; } bool flag = false; FormsAuthenticationTicket formsAuthenticationTicket = FormsAuthenticationModule.ExtractTicketFromCookie(e.Context, FormsAuthentication.FormsCookieName, out flag); if (formsAuthenticationTicket == null || formsAuthenticationTicket.Expired) { return; } FormsAuthenticationTicket formsAuthenticationTicket2 = formsAuthenticationTicket; if (FormsAuthentication.SlidingExpiration) { formsAuthenticationTicket2 = FormsAuthentication.RenewTicketIfOld(formsAuthenticationTicket); } e.Context.SetPrincipalNoDemand(new GenericPrincipal(new FormsIdentity(formsAuthenticationTicket2), new string[0])); if (!flag && !formsAuthenticationTicket2.CookiePath.Equals("/")) { httpCookie = e.Context.Request.Cookies[FormsAuthentication.FormsCookieName]; if (httpCookie != null) { httpCookie.Path = formsAuthenticationTicket2.CookiePath; } } if (formsAuthenticationTicket2 != formsAuthenticationTicket) { if (flag && formsAuthenticationTicket2.CookiePath != "/" && formsAuthenticationTicket2.CookiePath.Length > 1) { FormsAuthenticationTicket formsAuthenticationTicket3 = FormsAuthenticationTicket.FromUtc(formsAuthenticationTicket2.Version, formsAuthenticationTicket2.Name, formsAuthenticationTicket2.IssueDateUtc, formsAuthenticationTicket2.ExpirationUtc, formsAuthenticationTicket2.IsPersistent, formsAuthenticationTicket2.UserData, "/"); formsAuthenticationTicket2 = formsAuthenticationTicket3; } string text = FormsAuthentication.Encrypt(formsAuthenticationTicket2, !flag); if (flag) { e.Context.CookielessHelper.SetCookieValue('F', text); e.Context.Response.Redirect(e.Context.Request.RawUrl); return; } if (httpCookie != null) { httpCookie = e.Context.Request.Cookies[FormsAuthentication.FormsCookieName]; } if (httpCookie == null) { httpCookie = new HttpCookie(FormsAuthentication.FormsCookieName, text); httpCookie.Path = formsAuthenticationTicket2.CookiePath; } if (formsAuthenticationTicket2.IsPersistent) { httpCookie.Expires = formsAuthenticationTicket2.Expiration; } httpCookie.Value = text; httpCookie.Secure = FormsAuthentication.RequireSSL; httpCookie.HttpOnly = true; if (FormsAuthentication.CookieDomain != null) { httpCookie.Domain = FormsAuthentication.CookieDomain; } httpCookie.SameSite = FormsAuthentication.CookieSameSite; e.Context.Response.Cookies.Remove(httpCookie.Name); e.Context.Response.Cookies.Add(httpCookie); } }
private void OnEnter(object source, EventArgs eventArgs) { this._fOnEnterCalled = true; HttpApplication httpApplication = (HttpApplication)source; HttpContext context = httpApplication.Context; this.OnAuthenticate(new FormsAuthenticationEventArgs(context)); CookielessHelperClass cookielessHelper = context.CookielessHelper; if (AuthenticationConfig.AccessingLoginPage(context, FormsAuthentication.LoginUrl)) { context.SetSkipAuthorizationNoDemand(true, false); cookielessHelper.RedirectWithDetectionIfRequired(null, FormsAuthentication.CookieMode); } if (!context.SkipAuthorization) { context.SetSkipAuthorizationNoDemand(AssemblyResourceLoader.IsValidWebResourceRequest(context), false); } }
OnEnter方法註冊給了HttpApplication的AuthenticateRequest事件
/// <summary>Initializes the <see cref="T:System.Web.Security.FormsAuthenticationModule" /> object.</summary> /// <param name="app">The current <see cref="T:System.Web.HttpApplication" /> instance. </param> // Token: 0x06004BF8 RID: 19448 RVA: 0x00102EF4 File Offset: 0x001010F4 public void Init(HttpApplication app) { if (!FormsAuthenticationModule._fAuthChecked) { FormsAuthenticationModule._fAuthRequired = (AuthenticationConfig.Mode == AuthenticationMode.Forms); FormsAuthenticationModule._fAuthChecked = true; } if (FormsAuthenticationModule._fAuthRequired) { FormsAuthentication.Initialize(); app.AuthenticateRequest += this.OnEnter; app.EndRequest += this.OnLeave; } }