Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>It is not required to call <code>Response.Redirect</code> with <code>true</code> for <code>endResponse</code> to solve the security issue of outputting the page content after the redirect call. You can accomplish this another way and avoid causing a ThreadAbortException at the same time (<a href="https://stackoverflow.com/questions/1087777/is-response-end-considered-harmful/3917180#3917180">which is always bad</a>). Below are snippets of a page I created with 5 buttons that cause redirects in different ways, the <code>RedirectRenderOverride</code> button being the ideal as it is the one that triggers the Render method to do nothing. This has been tested with the NoRedirect add-in. Only two cases avoid outputting anything other than the 302 object moved response - <code>RedirectEnd</code> and <code>RedirectRenderOverride</code>.</p> <p><strong>Code In Front</strong></p> <pre><code>&lt;asp:Button ID="Button1" runat="server" OnClick="RedirectCompleteRequest" Text="RedirectCompleteRequest"/&gt; &lt;asp:Button ID="Button2" runat="server" OnClick="RedirectClear" Text="RedirectClear"/&gt; &lt;asp:Button ID="Button3" runat="server" OnClick="RedirectRenderOverride" Text="RedirectRenderOverride"/&gt; &lt;asp:Button ID="Button4" runat="server" OnClick="RedirectEnd" Text="RedirectEnd"/&gt; &lt;asp:Button ID="Button5" runat="server" OnClick="RedirectEndInTryCatch" Text="RedirectEndInTryCatch"/&gt; </code></pre> <p><strong>Code Behind</strong></p> <pre><code>public partial class _Default : Page { private bool _isTerminating; protected void RedirectEnd(object sender, EventArgs e) { Response.Redirect("Redirected.aspx"); } protected void RedirectCompleteRequest(object sender, EventArgs e) { Response.Redirect("Redirected.aspx", false); HttpContext.Current.ApplicationInstance.CompleteRequest(); } protected void RedirectClear(object sender, EventArgs e) { Response.Clear(); Response.Redirect("Redirected.aspx", false); } protected void RedirectRenderOverride(object sender, EventArgs e) { Response.Redirect("Redirected.aspx", false); _isTerminating = true; } protected void RedirectEndInTryCatch(object sender, EventArgs e) { try { Response.Redirect("Redirected.aspx"); } catch (ThreadAbortException) { // eat it } finally { Response.Write("Still doing stuff!"); } } protected override void RaisePostBackEvent(IPostBackEventHandler sourceControl, string eventArgument) { if (!_isTerminating) { base.RaisePostBackEvent(sourceControl, eventArgument); } } protected override void Render(HtmlTextWriter writer) { if (!_isTerminating) { base.Render(writer); } } } </code></pre> <p><code>Response.End</code> calls <code>Thread.CurrentThread.Abort</code> internally and, <a href="https://stackoverflow.com/questions/1559255/whats-wrong-with-using-thread-abort/1560567#1560567">according to Eric Lippert</a>, calling <code>Thread.Abort</code>, "is at best indicative of bad design, possibly unreliable, and extremely dangerous."</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload