CODEWITHSUNDEEP
asp.net
Waleed Eissa
Waleed Eissa

Reputation: 10533

How to drop/discard a Request in ASP.NET?

I'm trying to figure out how to drop/discard a request, I'm basically trying to implement a blocked list of IPs in my app to block spammers and I don't want to return any response (just ignore the request), is this possible in ASP.NET?

Edit: Some of the answers suggest that I could add them in the firewall, while this will certainly be better it's not suitable in my case. To make a long story short, I'm adding a moderation section to my website where moderators will check the posts awaiting moderation for spam (filtered by a spam fitler), I want the IP of the sender of some post to be added to the list of blocked IPs once a post is marked as spam by the moderator, this is why I wan to do it in the application.

Edit: Calling Response.End() returns a response to the user (even though it's empty), the whole purpose of my question was how not to return any response. Is this possible (even out of curiosity)? There's also Response.Close() which closes the socket but it sends notification (in TCP/IP) when it does this, I just wan to ignore as it if was never received (i.e. send nothing to the user)

Thanks

Upvotes: 7

Views: 1824

Answers (10)

Alex from Jitbit
Alex from Jitbit

Reputation: 60822

In ASP.NET Core call HttpContext.Abort() which simply closes the connection.

Upvotes: 0

Matas Vaitkevicius
Matas Vaitkevicius

Reputation: 61469

Here you go:

public class RequestDropper : IHttpModule
{
    public void Dispose()
    {
        throw new NotImplementedException();
    }

    public void Init(HttpApplication context)
    {
        context.BeginRequest += Context_BeginRequest;
    }

    public void Context_BeginRequest(object sender, EventArgs e)
    {
        var request = ((HttpApplication)sender).Context.Request;

        if (todayIAmNotInAMoodToProcessRequests)
        {
            request.Abort();
        }
    }
}

Hope this saves you some time

Upvotes: 2

annakata
annakata

Reputation: 75862

AFAIK there is no way to outright drop a request without a response. You can keep the request spinning in ASP.NET with whatever thread sleeping technique you like but you're not making life better for your server that way.

The best way that I know of to achieve what you want is having a traffic manager like ZXTM close the request before it gets to the webserver at all.

Upvotes: 0

Luk
Luk

Reputation: 5511

An other annoying but easy way to do it would be to Sleep the request for a discouraging amount of time before closing it.

Upvotes: 0

seanb
seanb

Reputation: 6954

You may want to have a look at this http://www.angrypets.com/tools/rdos/, which does a similar thing to what you are talking about, for similar reasons, and is implemented as a module.

Upvotes: 0

JackCorn
JackCorn

Reputation: 146

I would suggest the best solution is not to give a specific "no response" but to give a more discouraging standard http error message. Whenever I am attempting to discourage unauthorised users I issue a page/url not found message as follows:

throw new HttpException(404, "File not found - " + Request.AppRelativeCurrentExecutionFilePath);

I think that this is very effective at convincing the person at the other end to give up and go away.

Upvotes: 0

Kyle Trauberman
Kyle Trauberman

Reputation: 25694

EDIT: This might be better implemented as an HTTPModule instead of a handler, but the basic idea holds true. See http://www.kowitz.net/archive/2006/03/08/ihttpmodule-vs-ihttphandler.aspx for more details

You could probably do this using an httphandler, that way you won't have to worry about checking for this in your application code - its handled before your application is even executed.

Psudo code - not tested

class IgnoreHandler : IHttpHandler
{
    #region IHttpHandler Members

    public bool IsReusable
    {
        get { return true; }
    }

    public void ProcessRequest(HttpContext context)
    {
        context.Response.Clear();
        context.Response.StatusCode = 401;
        context.Response.Status = "Unauthorized";
        context.Response.End();
    }

    #endregion
}

Obviously, if you want it to return HTTP 200 (OK) and a blank page, just remove the two lines referring to the StatusCode and Status.

And then register it in web.config

<httpHandlers>
    <add verb="*" 
         path="*" 
         validate="false" 
         type="MyNamespace.IgnoreHandler, MyAssembly" />
</httpHandlers>

Upvotes: 2

Jason Jackson
Jason Jackson

Reputation: 17260

For this type of thing, I would go with an HTTP Module as opposed to doing this with a handler or a page.

Why use a module instead of a handler? An HTTP Module is called earlier in the request pipeline. For these type of blacklisted requests, you want to drop the request as early and fast as possible. This means the earlier in the request you can drop the request, the better.

You can read a little more about Modules vs Handlers here.

Upvotes: 4

Austin
Austin

Reputation: 4758

My first thought was what John suggested. The most ideal solution would be to add those IPs to the list of blocked IPs in your firewall if you have access to it, that way your application isn't having to do any processing at all.

Upvotes: 2

John Boker
John Boker

Reputation: 83719

Maybe you could use 

Response.Clear();
Response.End();

Upvotes: 3

Related Questions