In my day job I work for HP Enterprise Security Services, part of my role is building secure and robust web applications which do everything possible to prevent malicious attacks.
One of the most simple things you can do in your MVC project is to prevent repeat requests to a page. This is primarily used in form submissions, for example in the comment boxes, I don't want people to be able to repeatedly post to it over and over again, I want to introduce a time limit in-between these requests.
Also, there are going to be a lot of places on a typical site you want to limit such behaviour, but don't want to repeat the code everywhere. This is where custom Action Filter Attributes come in.
Creating an Attribute
Creating a custom attribute is easy, take a look at this piece of code, i'll explain what it does below:
<AttributeUsage(AttributeTargets.Method, AllowMultiple:=False)> Public NotInheritable Class RequestThrottleAttribute Inherits ActionFilterAttribute Public Overrides Sub OnActionExecuting(filterContext As ActionExecutingContext) 'Do some logic in here to decide what is going to happen End Sub End Class
What we're doing here is inheriting from the
ActionFilterAttribute, class and overriding the
OnActionExecuting method, which is where we will put our logic.
I have decorated this class with some attributes of there own,
AttributeTargets.Method states that this attribute can only be used on methods, and
AllowMultiple states that there can only be one instance of it.
Extending the base Attribute
The next thing to do is expand our logic out a bit. Lets make this attribute as flexible as possible, so for example lets make the amount of time between requests flexible, give the option to either Redirect when an error occurs or simple add an error to the
Start by adding some properties to represent our customisable options:
''' <summary> ''' The amount of time between each request ''' </summary> ''' <value></value> ''' <returns></returns> ''' <remarks></remarks> Public Property TimeBetweenRequests As Integer = 5 ''' <summary> ''' The name of the object in the ModelState to add an error too ''' </summary> ''' <value></value> ''' <returns></returns> ''' <remarks></remarks> Public Property ModelErrorName As String = Nothing ''' <summary> ''' The message to add to the ModelState object specified in ModelErrorName ''' </summary> ''' <value></value> ''' <returns></returns> ''' <remarks></remarks> Public Property ModelErrorValue As String = "Maximum number of requests exceeded" ''' <summary> ''' A URL to redirect to ''' </summary> ''' <value></value> ''' <returns></returns> ''' <remarks></remarks> Public Property RedirectOnError As String = Nothing
So in order to add an error to the
ModelState dictionary, we need need the name of the object to associate the error to (of course, this could just be an empty string for a generic error) - this is passed as
ModelErrorName, and we also need the message to set - this is passed in
If we wanted to redirect instead, we would set
Caching and Cache Expiration
Next, we need to customise the
OnActionExecuting method to do our throttling. We need to store somewhere the fact that a given user (lets define a user by their IP address as well as their user agent) has been to the page recently. I decided to generate a unique key from the information given, and store it in the
HttpContext.Cache and set it to expire on a time which is equal to the
TimeBetweenRequests parameter of our attribute. That way on the next request, all we need to do is check for the existence of the same key in the cache.
Take a look at the code below of the OnActionExecuting method:
Public Overrides Sub OnActionExecuting(filterContext As ActionExecutingContext) Dim HttpContext = filterContext.HttpContext 'Get the details of the path they're requesting Dim pathInfo = HttpContext.Request.ServerVariables("PATH_INFO") & filterContext.HttpContext.Request.ServerVariables("QUERY_STRING") 'Get who requested it, get their user agent as well, as multiple people in the same room could be coming from the same IP Dim requestedBy = HttpContext.Request.ServerVariables("REMOTE_ADDR") & HttpContext.Request.ServerVariables("HTTP_USER_AGENT") 'Generate a unique key based on it Dim key = MD5(pathInfo & requestedBy) 'Check to see if that key is in the cache If HttpContext.Cache.Get(key) IsNot Nothing Then 'Reject the request If ModelErrorName IsNot Nothing Then 'Add it to the modelstate filterContext.Controller.ViewData.ModelState.AddModelError(ModelErrorName, ModelErrorValue) End If If RedirectOnError IsNot Nothing Then 'Redirect filterContext.Result = New RedirectResult(RedirectOnError, False) End If Else 'Add it to the cache HttpContext.Cache.Add(key, New Object, Nothing, Now.AddSeconds(TimeBetweenRequests), Cache.NoSlidingExpiration, CacheItemPriority.Normal, Nothing) End If End Sub
In case you don't already have code to create an MD5 of a string, here it is, you'll need to import
Public Shared Function MD5(ByVal strToHash) As String Dim bytToHash As Byte() = ASCIIEncoding.ASCII.GetBytes(strToHash) Dim tmpHash As Byte() = (New MD5CryptoServiceProvider).ComputeHash(bytToHash) Dim i As Integer Dim sOutput As New StringBuilder(tmpHash.Length) For i = 0 To tmpHash.Length - 1 sOutput.Append(tmpHash(i).ToString("X2")) Next Return sOutput.ToString() End Function
Using the new Attribute
Now that your attribute is complete, all you need to do is implement it by decorating a given method with it. Take these two examples:
<HttpGet> <RequestThrottle(TimeBetweenRequests:=10, RedirectOnError:="/Error/Throttle")> Function TestThrottle() Return View(New TestThrottleViewModel) End Function
This action method will only allow one request per 10 seconds to the url /TestThrottle, before it redirects to an error page.
The next example will add the error to the ModelState instead, so you can return to the user on the same page:
<HttpPost> <RequestThrottle(TimeBetweenRequests:=10, ModelErrorName:="Comment", ModelErrorValue:="There is a 10 second wait between posts")> Function TestThrottle(ByVal model As TestThrottleViewModel) If ModelState.IsValid Then Return Content("Thanks") Else Return View(model) End If End Function
The simple view model that I have created for the post back contains just one item, "Comment", from there I've created a form using the .NET Html Helpers:
<% Using Html.BeginForm() %> <%: Html.ValidationSummary(True) %> <fieldset> <legend>TestThrottleViewModel</legend> <div class="editor-label"> <%: Html.LabelFor(Function(model) model.Comment) %> </div> <div class="editor-field"> <%: Html.EditorFor(Function(model) model.Comment) %> <%: Html.ValidationMessageFor(Function(model) model.Comment) %> </div> <p> <input type="submit" value="Create" /> </p> </fieldset> <% End Using %>
The first post back works fine, the second will result in the user being greeted with the error:
I hope this simple tutorial has helped you to think a little about your site security, as well as how to utilise custom Action Filters to reuse code across your website.
As always, any questions please ask.