Response.Redirect with POST instead of Get?
We have the requirement to take a form submission and save some data, then redirect the user to a page offsite, but in redirecting, we need to \"submit\" a form with POST, n
-
Thought it might interesting to share that heroku does this with it's SSO to Add-on providers
An example of how it works can be seen in the source to the "kensa" tool:
https://github.com/heroku/kensa/blob/d4a56d50dcbebc2d26a4950081acda988937ee10/lib/heroku/kensa/post_proxy.rb
And can be seen in practice if you turn of javascript. Example page source:
<!DOCTYPE HTML> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Heroku Add-ons SSO</title> </head> <body> <form method="POST" action="https://XXXXXXXX/sso/login"> <input type="hidden" name="email" value="XXXXXXXX" /> <input type="hidden" name="app" value="XXXXXXXXXX" /> <input type="hidden" name="id" value="XXXXXXXX" /> <input type="hidden" name="timestamp" value="1382728968" /> <input type="hidden" name="token" value="XXXXXXX" /> <input type="hidden" name="nav-data" value="XXXXXXXXX" /> </form> <script type="text/javascript"> document.forms[0].submit(); </script> </body> </html>讨论(0) -
Typically, all you'll ever need is to carry some state between these two requests. There's actually a really funky way to do this which doesn't rely on JavaScript (think <noscript/>).
Set-Cookie: name=value; Max-Age=120; Path=/redirect.htmlWith that cookie there, you can in the following request to /redirect.html retrieve the name=value info, you can store any kind of information in this name/value pair string, up to say 4K of data (typical cookie limit). Of course you should avoid this and store status codes and flag bits instead.
Upon receiving this request you in return respond with a delete request for that status code.
Set-Cookie: name=value; Max-Age=0; Path=/redirect.htmlMy HTTP is a bit rusty I've been going trough RFC2109 and RFC2965 to figure how reliable this really is, preferably I would want the cookie to round trip exactly once but that doesn't seem to be possible, also, third-party cookies might be a problem for you if you are relocating to another domain. This is still possible but not as painless as when you're doing stuff within your own domain.
The problem here is concurrency, if a power user is using multiple tabs and manages to interleave a couple of requests belonging to the same session (this is very unlikely, but not impossible) this may lead to inconsistencies in your application.
It's the <noscript/> way of doing HTTP round trips without meaningless URLs and JavaScript
I provide this code as a prof of concept: If this code is run in a context that you are not familiar with I think you can work out what part is what.
The idea is that you call Relocate with some state when you redirect, and the URL which you relocated calls GetState to get the data (if any).
const string StateCookieName = "state"; static int StateCookieID; protected void Relocate(string url, object state) { var key = "__" + StateCookieName + Interlocked .Add(ref StateCookieID, 1).ToInvariantString(); var absoluteExpiration = DateTime.Now .Add(new TimeSpan(120 * TimeSpan.TicksPerSecond)); Context.Cache.Insert(key, state, null, absoluteExpiration, Cache.NoSlidingExpiration); var path = Context.Response.ApplyAppPathModifier(url); Context.Response.Cookies .Add(new HttpCookie(StateCookieName, key) { Path = path, Expires = absoluteExpiration }); Context.Response.Redirect(path, false); } protected TData GetState<TData>() where TData : class { var cookie = Context.Request.Cookies[StateCookieName]; if (cookie != null) { var key = cookie.Value; if (key.IsNonEmpty()) { var obj = Context.Cache.Remove(key); Context.Response.Cookies .Add(new HttpCookie(StateCookieName) { Path = cookie.Path, Expires = new DateTime(1970, 1, 1) }); return obj as TData; } } return null; }讨论(0) -
You can use this aproach:
Response.Clear(); StringBuilder sb = new StringBuilder(); sb.Append("<html>"); sb.AppendFormat(@"<body onload='document.forms[""form""].submit()'>"); sb.AppendFormat("<form name='form' action='{0}' method='post'>",postbackUrl); sb.AppendFormat("<input type='hidden' name='id' value='{0}'>", id); // Other params go here sb.Append("</form>"); sb.Append("</body>"); sb.Append("</html>"); Response.Write(sb.ToString()); Response.End();As result right after client will get all html from server the event onload take place that triggers form submit and post all data to defined postbackUrl.
讨论(0) -
@Matt,
You can still use the HttpWebRequest, then direct the response you receive to the actual outputstream response, this would serve the response back to the user. The only issue is that any relative urls would be broken.
Still, that may work.
讨论(0) -
The GET (and HEAD) method should never be used to do anything that has side-effects. A side-effect might be updating the state of a web application, or it might be charging your credit card. If an action has side-effects another method (POST) should be used instead.
So, a user (or their browser) shouldn't be held accountable for something done by a GET. If some harmful or expensive side-effect occurred as the result of a GET, that would be the fault of the web application, not the user. According to the spec, a user agent must not automatically follow a redirect unless it is a response to a GET or HEAD request.
Of course, a lot of GET requests do have some side-effects, even if it's just appending to a log file. The important thing is that the application, not the user, should be held responsible for those effects.
The relevant sections of the HTTP spec are 9.1.1 and 9.1.2, and 10.3.
讨论(0) -
In PHP, you can send POST data with cURL. Is there something comparable for .NET?
Yes, HttpWebRequest, see my post below.
讨论(0)
加载中...
- 热议问题