Sholo.Web.Security/EnhancedSecurityModule.cs
/// <summary>
/// Intercepts the beginning of the request pipeline and performs analysis
/// and manipulation of FormsAuthenticationCookies prior to the 
/// FormsAuthenticationModule's AuthenticateRequest firing.  It stores some
/// information about the request in the Context.Items collection for analysis
/// later in the request pipeline execution.
/// </summary>
/// <param name="sender">The HttpApplication that sent the request</param>
/// <param name="e">Not used</param>
Intercepts the beginning of the request pipeline and performs analysis
and manipulation of FormsAuthenticationCookies prior to the
FormsAuthenticationModule's AuthenticateRequest firing.  It stores some
information about the request in the Context.Items collection for analysis
later in the request pipeline execution.
Intercepts the beginning of the request pipeline and performs analysis and manipulation of FormsAuthenticationCookies prior to the FormsAuthenticationModule ' s AuthenticateRequest firing . It stores some information about the request in the Context . Items collection for analysis later in the request pipeline execution .
private static void OnBeginRequest(object sender, EventArgs e)
        {
            HttpContext context = HttpContext.Current;
            HttpRequest request = context.Request;
            HttpResponse response = context.Response;
            if (request.RawUrl.Contains(".axd"))
            {
                context.Items["BewareOfCryptographicException"] = "true";                
            }
            if (request.QueryString["aspxerrorpath"] != null)
            {
                EnhancedSecurity.DelaySuspiciousResponse();
                string newUrl = RemovQueryStringArg("aspxerrorpath");
                response.Redirect(newUrl, false);
                response.End();
            }
            EnhancedSecurity.Initialize();                        
            HttpCookie formsAuthCookie = context.Request.Cookies[FormsAuthentication.FormsCookieName];
            RequestAnalysis analysis = RequestAnalyzer.AnalyzeRequest(formsAuthCookie, RequestLifecyclePhase.BeginRequest, true);
            if (analysis.RequestIsAuthenticated)
            {
                if (analysis.RequestIsMalicious)
                {
                    EnhancedSecurity.SetFormsAuthStatus(FormsAuthenticationStatus.Invalid);
                    EnhancedSecurity.DelayMaliciousResponse();
                }
                else if (!analysis.RequestIsValid)
                {
                    EnhancedSecurity.SetFormsAuthStatus(FormsAuthenticationStatus.Invalid);
                }
                else
                {
                    EnhancedSecurity.SetFormsAuthStatus(FormsAuthenticationStatus.Valid);
                    if (UserAuthentication.Enabled)
                    {
                        context.Items["OriginalCookieValue"] = analysis.FormsAuthenticationCookie.Value;
                        context.Items["ServerUserData"] = analysis.FormsAuthenticationTicket.UserData;
                        context.Items["ServerTicketKey"] = analysis.UserAuthenticationTicket.Key;
                        context.Items["UserAuthenticationTicket"] = analysis.UserAuthenticationTicket;
                        FormsAuthenticationTicket tempFormsAuthTicket = UserAuthentication.CreateFormsAuthTicket(
                            analysis.UserAuthenticationTicket.Username,
                            analysis.UserAuthenticationTicket.CookiePath,
                            analysis.UserAuthenticationTicket.TicketUserData, 
                            analysis.UserAuthenticationTicket.TicketIssueDate,
                            analysis.FormsAuthenticationTicket.Expiration,
                            false
                        );
                        UserAuthentication.SetAuthCookie(tempFormsAuthTicket, true, false);
                    }
                }
            }
            else
            {
                if (analysis.RequestIsMalicious)
                {
                    EnhancedSecurity.SetFormsAuthStatus(FormsAuthenticationStatus.Invalid);
                    EnhancedSecurity.DelayMaliciousResponse();
                }
                else
                {
                    EnhancedSecurity.SetFormsAuthStatus(FormsAuthenticationStatus.NotFound);
                }
            }
        }
private static void OnBeginRequest ( object sender , EventArgs e ) { HttpContext context = HttpContext . Current ; HttpRequest request = context . Request ; HttpResponse response = context . Response ; if ( request . RawUrl . Contains ( " " ) ) { context . Items [ " " ] = " " ; } if ( request . QueryString [ " " ] != null ) { EnhancedSecurity . DelaySuspiciousResponse ( ) ; string newUrl = RemovQueryStringArg ( " " ) ; response . Redirect ( newUrl , false ) ; response . End ( ) ; } EnhancedSecurity . Initialize ( ) ; HttpCookie formsAuthCookie = context . Request . Cookies [ FormsAuthentication . FormsCookieName ] ; RequestAnalysis analysis = RequestAnalyzer . AnalyzeRequest ( formsAuthCookie , RequestLifecyclePhase . BeginRequest , true ) ; if ( analysis . RequestIsAuthenticated ) { if ( analysis . RequestIsMalicious ) { EnhancedSecurity . SetFormsAuthStatus ( FormsAuthenticationStatus . Invalid ) ; EnhancedSecurity . DelayMaliciousResponse ( ) ; } else if ( ! analysis . RequestIsValid ) { EnhancedSecurity . SetFormsAuthStatus ( FormsAuthenticationStatus . Invalid ) ; } else { EnhancedSecurity . SetFormsAuthStatus ( FormsAuthenticationStatus . Valid ) ; if ( UserAuthentication . Enabled ) { context . Items [ " " ] = analysis . FormsAuthenticationCookie . Value ; context . Items [ " " ] = analysis . FormsAuthenticationTicket . UserData ; context . Items [ " " ] = analysis . UserAuthenticationTicket . Key ; context . Items [ " " ] = analysis . UserAuthenticationTicket ; FormsAuthenticationTicket tempFormsAuthTicket = UserAuthentication . CreateFormsAuthTicket ( analysis . UserAuthenticationTicket . Username , analysis . UserAuthenticationTicket . CookiePath , analysis . UserAuthenticationTicket . TicketUserData , analysis . UserAuthenticationTicket . TicketIssueDate , analysis . FormsAuthenticationTicket . Expiration , false ) ; UserAuthentication . SetAuthCookie ( tempFormsAuthTicket , true , false ) ; } } } else { if ( analysis . RequestIsMalicious ) { EnhancedSecurity . SetFormsAuthStatus ( FormsAuthenticationStatus . Invalid ) ; EnhancedSecurity . DelayMaliciousResponse ( ) ; } else { EnhancedSecurity . SetFormsAuthStatus ( FormsAuthenticationStatus . NotFound ) ; } } }
Intercepts the beginning of the request pipeline and performs analysis
and manipulation of FormsAuthenticationCookies prior to the
FormsAuthenticationModule's AuthenticateRequest firing.
Intercepts the beginning of the request pipeline and performs analysis and manipulation of FormsAuthenticationCookies prior to the FormsAuthenticationModule ' s AuthenticateRequest firing .
// analyzer.FormsAuthenticationCookie.Value; // Substitute actual UserData from serverTicket
sender
object
The HttpApplication that sent the request
The HttpApplication that sent the request
e
EventArgs
None