输入验证和表示 - 标题操作：Cookies - C# Cookies - 标题

问题描述

Fortify 报告了以下问题 输入验证和表示 - 标题操作：Cookie

HttpApplication application = (HttpApplication)source;
            if (application.Context.Handler is IRequiresSessionState)
            {
                string abcCookieIdentity = "abc";
                HttpCookie abcCookie = application.Request.Cookies[abcCookieIdentity];                
                if (abcCookie == null)
                {
                    string mockIdentity = ConfigurationUtility.GetValue("AbcmockIdentity");
                    if (!string.IsNullOrWhiteSpace(mockIdentity))
                    {
                        abcCookie = new HttpCookie(abcCookieIdentity);
                        abcCookie.Secure = true;
                        abcCookie.HttpOnly = true;
                        abcCookie.Value = application.Session.SessionID + "#" + mockIdentity;
                        application.Response.Cookies.Add(abcCookie);
                    }
                }

            if (abcCookie != null)
            {
                if (application.Session != null)
                {
                    string internalSessionId = application.Session.SessionID;
                    abcCookie.Secure = true;
                    string[] cookieValues = abcCookie.Value.Split('#');

                    if (cookieValues[0].Equals(internalSessionId))
                    {
                        IIdentity identity = identity = new GenericI(cookieValues[1]);
                        IPrincipal principal = new GenericP(identity,new string[] { "Gent" });
                        Thread.CurrentPrincipal = principal;
                        application.Context.User = principal;

                        application.Request.Headers.Add("USER",cookieValues[1]);
                        
                        application.Response.Cookies.Add(abcCookie);

                        return;
                    }
                }
            }                
        }

我尝试通过添加更多详细信息（如 cookie 过期等）来解决。仍然没有任何效果。 任何帮助将不胜感激..谢谢！

解决方法

我必须在我的代码中使用 Request.Form["values"] .. 解决了这个问题。