ASP.NET Ajax客户端框架损害了HTTPS安全性

时间:2019-03-18 16:40:25

标签: asp.net ajax iis mixed-content

我在aspx ASP.NET网页中有一个ScriptManager。

如果我使用以下

<asp:ScriptManager EnablePartialRendering="true" AsyncPostBackTimeOut="300"
        ID="ScriptManager1" runat="server" />

我在浏览器中看到以下错误

  

未捕获的错误:ASP.NET Ajax客户端框架无法加载。   未捕获的ReferenceError:未定义Sys

当我添加EnableCdn="true"时,我会收到有关读取的混合内容的警告

  

http://ajax.aspnetcdn.com/ajax/4.6/1/WebForms.js ...和http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.debug.js损害了HTTPS安全性

当然,如果我强行加载,它最终会起作用,但这与理想情况相去甚远。

我也不明白在从Windows Server 2012移植到带有IIS 8和10的各个版本的Windows Server 2016的过程中出现了什么问题。显然,在原始服务器中,相同的代码可以正常工作-即使没有{ {1}}-所有这些请求似乎都按预期在https中进行管理。

接受解决方案后

几乎一切顺利。 我所做的是在EnableCdn="true"内添加以下行:

Global.asax.cs

唯一仍然是KO的是 protected void Application_Start(object sender, EventArgs e) { //.... var defAjaxForms = new ScriptResourceDefinition(); defAjaxForms.CdnPath = "https://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.js"; defAjaxForms.CdnDebugPath = "https://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.js"; defAjaxForms.CdnSupportsSecureConnection = true; defAjaxForms.Path = "~/Scripts/WebForms/MicrosoftAjaxWebForms.debug.js";//local resource defAjaxForms.DebugPath = "~/Scripts/WebForms/MicrosoftAjaxWebForms.debug.js"; ScriptManager.ScriptResourceMapping.AddDefinition("MicrosoftAjaxWebForms.js", defAjaxForms); var defAjax = new ScriptResourceDefinition(); defAjax.CdnPath = "https://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.js"; defAjax.CdnDebugPath = "https://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.js"; defAjax.CdnSupportsSecureConnection = true; defAjax.Path = "~/Scripts/WebForms/MicrosoftAjax.js";//local resource defAjax.DebugPath = "~/Scripts/WebForms/MicrosoftAjax.js"; defAjax.LoadSuccessExpression = "window.Sys && Sys._Application && Sys.Observer"; ScriptManager.ScriptResourceMapping.AddDefinition("MicrosoftAjax.js", defAjax); var defForms = new ScriptResourceDefinition(); defForms.CdnPath = "https://ajax.aspnetcdn.com/ajax/4.6/1/WebForms.js"; defForms.CdnDebugPath = "https://ajax.aspnetcdn.com/ajax/4.6/1/WebForms.js"; defForms.CdnSupportsSecureConnection = true; defForms.Path = "~/Scripts/WebForms/WebForms.js"; defForms.DebugPath = "~/Scripts/WebForms/WebForms.js"; defForms.LoadSuccessExpression = "window.Sys && Sys._Application && Sys.Observer"; ScriptManager.ScriptResourceMapping.AddDefinition("WebForms.js", defForms); } :我还在得到

  

...已通过HTTPS加载,但请求了不安全的脚本   'http://ajax.aspnetcdn.com/ajax/4.6/1/WebForms.js'。这个要求有   被封锁;内容必须通过HTTPS提供。

最终解决方案

最后,我对所有{{1}都应用了this answer(注意,它们定义了WebForms.jsResourceName而不是ResourceAssemblyPath) }替换为DebugPath

1 个答案:

答案 0 :(得分:0)

您可以在“隐藏代码”中配置ScriptManager映射。这样的事情。 Page_PreRender是个不错的地方。

Dim def As New ScriptResourceDefinition()
def.CdnPath = "https://ajax.aspnetcdn.com/ajax/4.0/1/MicrosoftAjax.js"
def.CdnDebugPath = "https://ajax.aspnetcdn.com/ajax/4.0/1/MicrosoftAjax.js"
def.CdnSupportsSecureConnection = True
def.Path = "~/js/lib/MicrosoftAjax.js" ''//local resource
def.DebugPath = "~/js/lib/MicrosoftAjax.js"
def.LoadSuccessExpression = "window.Sys && Sys._Application && Sys.Observer"
ScriptManager.ScriptResourceMapping.AddDefinition("MicrosoftAjax.js", def)