如何修复ASP.NET中的验证码漏洞错误

Answer 1

这对我有用

    protected bool Validate()
    {
        string Response = Request["g-recaptcha-response"];//Getting Response String Append to Post Method

        if ((txtUsername.Text != (Session["PreviousLoginUsername"] ?? string.Empty).ToString() ||
            txtPassword.Text != (Session["PreviousLoginPassword"] ?? string.Empty).ToString()) &&
            (Response == (Session["PreviousLoginCaptcha"] ?? string.Empty).ToString()))
        {
            return false;
        }

        bool Valid = false;
        //Request to Google Server
        HttpWebRequest req = (HttpWebRequest)WebRequest.Create
        (" https://www.google.com/recaptcha/api/siteverify?secret=6Ld6ALQUAAAAAIVP2u4dTDCnSFG5Yxa8bG8P9rFm&response=" + Response);
        try
        {
            //Google recaptcha Response
            using (WebResponse wResponse = req.GetResponse())
            {

                using (StreamReader readStream = new StreamReader(wResponse.GetResponseStream()))
                {
                    string jsonResponse = readStream.ReadToEnd();

                    JavaScriptSerializer js = new JavaScriptSerializer();
                    MyObject data = js.Deserialize<MyObject>(jsonResponse);// Deserialize Json

                    Valid = Convert.ToBoolean(data.success);
                }
            }

            if (Valid)
            {
                Session["PreviousLoginCaptcha"] = Response;
                Session["PreviousLoginUsername"] = txtUsername.Text;
                Session["PreviousLoginPassword"] = txtPassword.Text;
            }

            return Valid;
        }
        catch (WebException ex)
        {
            throw ex;
        }
    }