Asp.net 具有FriendlyURL的QueryStringModule不工作

早上好，我需要加密我的查询字符串，我发现了一个有趣的方法，并在vb.net中转换它：

Imports System
Imports System.IO
Imports System.Web
Imports System.Text
Imports System.Security.Cryptography

Public Class QueryStringModule
    Implements IHttpModule

    Public Sub Dispose() Implements IHttpModule.Dispose
    End Sub

    Public Sub Init(ByVal context As HttpApplication) Implements IHttpModule.Init
        AddHandler context.BeginRequest, New EventHandler(AddressOf context_BeginRequest)
    End Sub

    Private Const PARAMETER_NAME As String = "enc="
    Private Const ENCRYPTION_KEY As String = "key"

    Private Sub context_BeginRequest(ByVal sender As Object, ByVal e As EventArgs)
        Dim context As HttpContext = HttpContext.Current

        If context.Request.Url.OriginalString.Contains("aspx") AndAlso context.Request.RawUrl.Contains("?") Then
            Dim query As String = ExtractQuery(context.Request.RawUrl)
            Dim path As String = GetVirtualPath()

            If query.StartsWith(PARAMETER_NAME, StringComparison.OrdinalIgnoreCase) Then
                Dim rawQuery As String = query.Replace(PARAMETER_NAME, String.Empty)
                Dim decryptedQuery As String = Decrypt(rawQuery)
                context.RewritePath(path, String.Empty, decryptedQuery)
            ElseIf context.Request.HttpMethod = "GET" Then
                Dim encryptedQuery As String = Encrypt(query)
                context.Response.Redirect(path & encryptedQuery)
            End If
        End If
    End Sub

    Private Shared Function GetVirtualPath() As String
        Dim path As String = HttpContext.Current.Request.RawUrl
        path = path.Substring(0, path.IndexOf("?"))
        path = path.Substring(path.LastIndexOf("/") + 1)
        Return path
    End Function

    Private Shared Function ExtractQuery(ByVal url As String) As String
        Dim index As Integer = url.IndexOf("?") + 1
        Return url.Substring(index)
    End Function

    Private ReadOnly Shared SALT As Byte() = Encoding.ASCII.GetBytes(ENCRYPTION_KEY.Length.ToString())

    Public Shared Function Encrypt(ByVal inputText As String) As String
        Dim rijndaelCipher As RijndaelManaged = New RijndaelManaged()
        Dim plainText As Byte() = Encoding.Unicode.GetBytes(inputText)
        Dim SecretKey As PasswordDeriveBytes = New PasswordDeriveBytes(ENCRYPTION_KEY, SALT)

        Using encryptor As ICryptoTransform = rijndaelCipher.CreateEncryptor(SecretKey.GetBytes(32), SecretKey.GetBytes(16))

            Using memoryStream As MemoryStream = New MemoryStream()

                Using cryptoStream As CryptoStream = New CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write)
                    cryptoStream.Write(plainText, 0, plainText.Length)
                    cryptoStream.FlushFinalBlock()
                    Return "?" & PARAMETER_NAME & Convert.ToBase64String(memoryStream.ToArray())
                End Using
            End Using
        End Using
    End Function

    Public Shared Function Decrypt(ByVal inputText As String) As String
        Dim rijndaelCipher As RijndaelManaged = New RijndaelManaged()
        Dim encryptedData As Byte() = Convert.FromBase64String(inputText)
        Dim secretKey As PasswordDeriveBytes = New PasswordDeriveBytes(ENCRYPTION_KEY, SALT)

        Using decryptor As ICryptoTransform = rijndaelCipher.CreateDecryptor(secretKey.GetBytes(32), secretKey.GetBytes(16))

            Using memoryStream As MemoryStream = New MemoryStream(encryptedData)

                Using cryptoStream As CryptoStream = New CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read)
                    Dim plainText As Byte() = New Byte(encryptedData.Length - 1) {}
                    Dim decryptedCount As Integer = cryptoStream.Read(plainText, 0, plainText.Length)
                    Return Encoding.Unicode.GetString(plainText, 0, decryptedCount)
                End Using
            End Using
        End Using
    End Function
End Class

但是我的项目也使用FriendlyURL，我发现FriendlyURL不起作用，总是返回不带扩展名“.aspx”的url，但查询字符串没有加密

Imports System.Web.Routing
Imports Microsoft.AspNet.FriendlyUrls

Public Module RouteConfig
    Sub RegisterRoutes(ByVal routes As RouteCollection)
        Dim settings As FriendlyUrlSettings = New FriendlyUrlSettings() With {
            .AutoRedirectMode = RedirectMode.Permanent
        }
        routes.EnableFriendlyUrls(settings)
    End Sub
End Module

当然，如果我将

.AutoRedirectMode

设置为

关闭

，它可以工作，但没有友好的URL

我做错什么了吗

2019年10月9日编辑：

我们发现在

上下文中删除对OriginalString.Contains（“aspx”）的测试\u BeginRequest

加密工作正常，现在代码如下：

Private Sub context_BeginRequest(ByVal sender As Object, ByVal e As EventArgs)
        Dim context As HttpContext = HttpContext.Current

        If context.Request.RawUrl.Contains("?") Then
            Dim query As String = ExtractQuery(context.Request.RawUrl)
            Dim path As String = GetVirtualPath()

            If query.StartsWith(PARAMETER_NAME, StringComparison.OrdinalIgnoreCase) Then
                Dim rawQuery As String = query.Replace(PARAMETER_NAME, String.Empty)
                Dim decryptedQuery As String = Decrypt(rawQuery)
                context.RewritePath(path, String.Empty, decryptedQuery)
            ElseIf context.Request.HttpMethod = "GET" Then
                Dim encryptedQuery As String = Encrypt(query)
                context.Response.Redirect(path & encryptedQuery)
            End If
        End If
    End Sub

---

但现在的问题是：有没有其他方法可以不测试扩展就以aspx页面为目标？我认为存在一种风险，即针对不应该针对的对象，例如“ashx”或使用查询字符串的缓存破坏代码。

BeginRequest sub正在检查url是否包含“aspx”-您是否尝试删除此检查？删除“context.Request.Url.OriginalString.Contains”（“aspx”）和“@SimonEvans我尝试过，它可以工作，但它不会测试不应该测试的东西吗？例如“.ashx”或类似

中的解压代码是的。当你问这个问题的时候，我希望能有一个解决办法，但是没有乐趣。您需要进行一些其他检查，以查看请求是否针对的是aspx页面，而不是其他资源，但我画的是空白。很抱歉