CreateUserWizard用户名和电子邮件枚举

Question

我一直在对我们的网站进行安全审查，发现了CreateUserWizard的一个问题。我们不允许人们注册一个重复的电子邮件地址或用户名。CreateUserWizard将为我验证这一点，但问题是，我可以编写一个脚本来访问我们的服务器并尝试用户名，并且可以很快地通过枚举获得用户名列表。

我想添加recaptcha，但在验证用户名之前，我似乎无法让它验证这一点。有办法这样做吗？

    <asp:CreateUserWizard ID="CreateUserWizard1" runat="server" OnCreatedUser="CreateUserWizard1_CreatedUser" ContinueDestinationPageUrl="~/PleaseVerify.aspx" CssClass="CreateUserWizard" StepNextButtonStyle-CssClass="NextButton" StartNextButtonStyle-CssClass="NextButton" FinishCompleteButtonStyle-CssClass="FinishButton" CreateUserButtonText="Create my ID"
        CompleteSuccessText="Your account has been created, but before you can login you must first verify your email address. A message has been sent to the email address you specified. Please check your email inbox and follow the instructions in that email to verify your account."
        DisableCreatedUser="True" OnSendingMail="CreateUserWizard1_SendingMail" DuplicateUserNameErrorMessage="That username is already in use, if you think this is you can LINK REMOVED Otherwise try a different username."
        DuplicateEmailErrorMessage="That email is already in use, try to <a href='/ForgotPassword.aspx'>recover your password</a>." InvalidPasswordErrorMessage="Please supply at least five letters in your password.">

Answer 1

我不认为用户名是在客户端验证的，因此您可以重写CreateUserWizard的CreateUserError事件处理程序，检查您的captcha，并且不返回用户名已经在使用的错误。我使用我从www.codinghorror.com (http://www.codinghorror.com/blog/2004/11/captcha-control-coda.html)拼凑在一起的自定义控件captcha，它在后端代码试图创建用户并确定用户名/电子邮件正在使用之前触发。

Answer 2

最后，我没有使用create向导，而只是在按钮处理程序中进行简单的登录。

    recaptcha.Validate();
    if (!recaptcha.IsValid)
    {
        ErrorMessage.Text = "Invalid Code.";
        return;
    }
    if (!IsValid)
    {
        return;
    }
    var duplicateEmail = Membership.FindUsersByEmail(Email.Text);
    if (duplicateEmail.Count > 0)
    {
        ErrorMessage.Text = "That email is already in use, try to <a href='/ForgotPassword.aspx'>recover your password</a>.";
        return;   
    }
    var duplicateUsername = Membership.FindUsersByName(UserName.Text);
    if (duplicateUsername.Count > 0)
    {
         ErrorMessage.Text = "That username is already in use, if you think this is you can <a href='http://www.nanaimo.ca/dashboard/'>login</a>, otherwise try a different username.";
         return;   
    }
    var newUser = Membership.CreateUser(UserName.Text, Password.Text, Email.Text);
    newUser.IsApproved = false;
    Membership.UpdateUser(newUser);