114 lines
No EOL
3.7 KiB
C#
114 lines
No EOL
3.7 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.Security.Claims;
|
|
using System.Security.Principal;
|
|
using System.Web;
|
|
using System.Web.Security;
|
|
using System.Web.UI;
|
|
using System.Web.UI.WebControls;
|
|
|
|
using AyABL.AUT.Encripta;
|
|
|
|
public partial class SiteMaster : MasterPage
|
|
{
|
|
private const string AntiXsrfTokenKey = "__AntiXsrfToken";
|
|
private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";
|
|
private string _antiXsrfTokenValue;
|
|
|
|
EncriptaBL objEncriptaBL;
|
|
|
|
|
|
protected void Page_Init(object sender, EventArgs e)
|
|
{
|
|
// El código siguiente ayuda a proteger frente a ataques XSRF
|
|
var requestCookie = Request.Cookies[AntiXsrfTokenKey];
|
|
Guid requestCookieGuidValue;
|
|
if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))
|
|
{
|
|
// Utilizar el token Anti-XSRF de la cookie
|
|
_antiXsrfTokenValue = requestCookie.Value;
|
|
Page.ViewStateUserKey = _antiXsrfTokenValue;
|
|
}
|
|
else
|
|
{
|
|
// Generar un nuevo token Anti-XSRF y guardarlo en la cookie
|
|
_antiXsrfTokenValue = Guid.NewGuid().ToString("N");
|
|
Page.ViewStateUserKey = _antiXsrfTokenValue;
|
|
|
|
var responseCookie = new HttpCookie(AntiXsrfTokenKey)
|
|
{
|
|
HttpOnly = true,
|
|
Value = _antiXsrfTokenValue
|
|
};
|
|
if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)
|
|
{
|
|
responseCookie.Secure = true;
|
|
}
|
|
Response.Cookies.Set(responseCookie);
|
|
}
|
|
|
|
Page.PreLoad += master_Page_PreLoad;
|
|
|
|
if (Request.Form["__EVENTTARGET"] == "Inicio")
|
|
{
|
|
btnInicio_Click(this, new EventArgs());
|
|
}
|
|
else if (Request.Form["__EVENTTARGET"] == "finSession")
|
|
{
|
|
btnFin_Click(this, new EventArgs());
|
|
}
|
|
}
|
|
|
|
protected void master_Page_PreLoad(object sender, EventArgs e)
|
|
{
|
|
if (!IsPostBack)
|
|
{
|
|
// Establecer token Anti-XSRF
|
|
ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;
|
|
ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty;
|
|
}
|
|
else
|
|
{
|
|
// Validar el token Anti-XSRF
|
|
if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue
|
|
|| (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty))
|
|
{
|
|
throw new InvalidOperationException("Error de validación del token Anti-XSRF.");
|
|
}
|
|
}
|
|
}
|
|
|
|
protected void Page_Load(object sender, EventArgs e)
|
|
{
|
|
try
|
|
{
|
|
if (!IsPostBack)
|
|
{
|
|
lblUsuarioLogueado.Text = "Bienvenido " + Session["LOGIN"].ToString();
|
|
lblRol.Text = Session["ROL"].ToString();
|
|
}
|
|
}
|
|
catch (Exception)
|
|
{
|
|
Response.Redirect("~/wfrLogin.aspx");
|
|
throw new InvalidOperationException("La sesión ha expirado");
|
|
}
|
|
|
|
}
|
|
|
|
protected void btnInicio_Click(object sender, EventArgs e)
|
|
{
|
|
objEncriptaBL = new EncriptaBL();
|
|
|
|
Response.Redirect("~/webforms/wfrIndex.aspx" + "?l=" + objEncriptaBL.Encryptar(Session["LOGIN"].ToString()) + "&u=" + objEncriptaBL.Encryptar(Session["PKUSUARIO"].ToString()), false);
|
|
}
|
|
|
|
protected void btnFin_Click(object sender, EventArgs e)
|
|
{
|
|
Session.Abandon();
|
|
Session["LOGIN"] = null;
|
|
Session["PKUSUARIO"] = null;
|
|
|
|
Response.Redirect("~/wfrLogin.aspx");
|
|
}
|
|
} |