我的代码获取用户名和密码,并通过ajax将其传递到我在域上进行身份验证的服务器端代码。返回的字符串为true。是否有可能黑客以某种方式注入真正的反应进入该网站? c#
if (Request.Form["MethodName"] == "auththenticate")
{
string u = Request.Form["username"].ToString();
string p = Request.Form["password"].ToString();
bool valid = false;
using (PrincipalContext context = new PrincipalContext(ContextType.Domain))
{
valid = context.ValidateCredentials(u, p);
}
HttpContext.Current.Response.Write(valid);
HttpContext.Current.Response.End();
}
ajax调用的成功函数:success:function(json){
if (json == "True") {
$("#loginDialog").dialog("destroy"); var authenticated = true
} else {
$("#username").val("");
$("#password").val("");
$("#fail").css(visibility, "visible");
}