问主域上的网站+子域上的安全MVC web应用

EN

<system.webServer>
    <rewrite>
        <rules>
            <rule name="subdomain" stopProcessing="true">
                <match url="(.*)" />
                <conditions>
                    <add input="{HTTP_HOST}" pattern="^(secure.)somedomain.com$" />
                </conditions>
                <action type="Rewrite" url="\secure\{R:0}" />
            </rule>
            <rule name="subfolder" stopProcessing="true">
                <match url=".*" />
                <conditions>
                    <add input="{URL}" matchType="Pattern" pattern="^(http://|https://)?(www)?[^/]*/secure" ignoreCase="true" negate="false" />
                </conditions>
                <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
            </rule>
        </rules>
    </rewrite>
</system.webServer>

public class SubdomainRoute : Route
{
    private const string _subdomain = "secure";

    public SubdomainRoute(string url) : base(url, new MvcRouteHandler()) { }

    public override RouteData GetRouteData(HttpContextBase httpContext)
    {
        var routeData = base.GetRouteData(httpContext);
        if (routeData == null) return null; // Only look at the subdomain if this route matches in the first place.

        // A subdomain specified as a query parameter takes precedence over the hostname.
        var subdomain = httpContext.Request.Params[_subdomain];
        if (subdomain == null)
        {
            var host = httpContext.Request.Headers["Host"];
            var index = host.IndexOf('.');
            if (index >= 0) subdomain = host.Substring(0, index);
        }
        if (subdomain != null) routeData.Values[_subdomain] = subdomain;
        return routeData;
    }

    public override VirtualPathData GetVirtualPath(RequestContext requestContext, RouteValueDictionary values)
    {
        var subdomainParam = requestContext.HttpContext.Request.Params[_subdomain];
        if (subdomainParam != null) values[_subdomain] = subdomainParam;
        return base.GetVirtualPath(requestContext, values);
    }
}

public static void RegisterRoutes(RouteCollection routes)
{
    routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
    routes.Add(
        "Default",
        new SubdomainRoute("{controller}/{action}/{id}")
        {
            Defaults = new RouteValueDictionary(
                new { controller = MVC.Home.Name, action = MVC.Home.ActionNames.Index, id = UrlParameter.Optional }),
            Constraints = new RouteValueDictionary(
                new { controller = @"[^\.]*" })
        });
}

public class SubdomainRouteConstraint : IRouteConstraint
{
    private readonly string _subdomain;

    public SubdomainRouteConstraint(string subdomain)
    {
        _subdomain = subdomain;
    }

    public bool Match(
        HttpContextBase httpContext,
        Route route,
        string parameterName,
        RouteValueDictionary values,
        RouteDirection routeDirection)
    {
        return httpContext.Request.Url != null && httpContext.Request.Url.Host.StartsWith(_subdomain);
    }
}

public static void RegisterRoutes(RouteCollection routes)
{
    routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
    routes.MapRoute(
        "Default" /* Route name */,
        "{controller}/{action}/{id}" /* URL with parameters */,
        new { controller = MVC.Home.Name, action = MVC.Home.ActionNames.Index, id = UrlParameter.Optional } /* Parameter defaults */,
        new { controller = @"[^\.]*", subdomain = new SubdomainRouteConstraint("secure") } /* Parameter constraints */);
}