Asp.Net CORS 安全问题

Question

我在 asp.net 核心 API 中制定了 CORS 策略，但 public 似乎可以访问 API，正如我所看到的 JSON 只需在浏览器中输入 API URL。所以我只希望我的前端（API 同一主机中的 angular 应用程序）能够访问 API 而不是所有人。这是我的启动 class:

public class Startup
{
    readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy(name: MyAllowSpecificOrigins,
                              builder =>
                              {
                                  builder.WithOrigins("myurl")
                                   .AllowAnyHeader()
                                   .AllowAnyMethod(); 
                              });
        });
        services.AddControllers().AddJsonOptions(options =>
        {
            options.JsonSerializerOptions.PropertyNamingPolicy = null;
            options.JsonSerializerOptions.DictionaryKeyPolicy = null;
        });

        services.Configure<FormOptions>(o =>
        {
            o.ValueLengthLimit = int.MaxValue;
            o.MultipartBodyLengthLimit = int.MaxValue;
            o.MemoryBufferThreshold = int.MaxValue;
        });

        services.AddControllers();
        string connectionString = "xxx";
        services.AddDbContext<decorContext>(
          option => option.UseSqlServer(connectionString)
            );
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
       
        app.UseDefaultFiles();
        app.UseStaticFiles();
       
        app.UseStaticFiles(new StaticFileOptions()
        {
            FileProvider = new PhysicalFileProvider(Path.Combine(Directory.GetCurrentDirectory() ,@"StaticFiles")),
            RequestPath = new PathString("/StaticFiles")
        });

        app.UseRouting();
        app.UseCors(MyAllowSpecificOrigins);
        app.UseAuthorization();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

Answer 1

CORS 在域 A 访问域 B 时启动（例如在 js 中进行 ajax 调用），当您直接点击 url 时它不会应用。这就是它被称为 CROSS-ORIGIN 的原因。

您通常不会实施“脚本 -> 网站”限制。您可以通过 location/IP、用户 identity/role/claims 或检查请求中是否存在防伪令牌来限制访问。查看 Overview of ASP.NET Core Security

Asp.Net CORS 安全问题

Asp.Net CORS security issue

api

asp.net-core

cross-domain