如何在C# MVC网站中支持虚拟文件？泛域名站点适配问询

Hey there! Let's work through adding virtual file support to your catch-all subdomain setup—this is a common scenario when building user-hosted site platforms, so I’ve got some practical steps to share.

First, let’s recap your setup: you’ve got a catch-all domain where each subdomain maps to a user’s uploaded site files in a subdirectory, and your current global.asax error handler handles missing /index.html requests. To support virtual files (paths that don’t correspond to physical files on the server, like SPA routes or custom user-defined paths), we’ll want to shift from reacting to 404 errors to proactively routing every request to the correct user’s site, whether the file exists or not.

Here’s how to implement this:

1. Move Routing Logic to Application_BeginRequest #

Instead of waiting for a 404 error to trigger your handler, intercept requests as they start. This lets you handle both existing files and virtual paths seamlessly. Add this to your global.asax:

protected void Application_BeginRequest(object sender, EventArgs e)
{
    var context = HttpContext.Current;
    var request = context.Request;
    var host = request.Url.Host;

    // Skip main domain (e.g., www.example.com or example.com)
    var domainParts = host.Split('.');
    if (domainParts.Length < 3) return;

    // Extract username from subdomain (e.g., user1.example.com → user1)
    var userName = domainParts[0];
    var userSiteVirtualRoot = $"~/UserSites/{userName}/";
    var userSitePhysicalRoot = context.Server.MapPath(userSiteVirtualRoot);

    // If the user's directory doesn't exist, return 404
    if (!Directory.Exists(userSitePhysicalRoot))
    {
        context.Response.StatusCode = 404;
        context.Response.End();
        return;
    }

    // Get the requested path relative to the subdomain
    var requestedPath = request.Path.TrimStart('/');
    var targetPhysicalPath = Path.Combine(userSitePhysicalRoot, requestedPath);

    // Critical: Prevent path traversal attacks (e.g., ../../otheruser/file.txt)
    var normalizedUserRoot = Path.GetFullPath(userSitePhysicalRoot);
    var normalizedTargetPath = Path.GetFullPath(targetPhysicalPath);
    if (!normalizedTargetPath.StartsWith(normalizedUserRoot, StringComparison.OrdinalIgnoreCase))
    {
        context.Response.StatusCode = 403;
        context.Response.End();
        return;
    }

    // Handle existing files/attachments directly
    if (File.Exists(targetPhysicalPath) || Directory.Exists(targetPhysicalPath))
    {
        context.RewritePath($"{userSiteVirtualRoot}{requestedPath}");
    }
    else
    {
        // Route virtual paths to the user's entry point (usually index.html)
        context.RewritePath($"{userSiteVirtualRoot}index.html");
    }
}

2. Key Details to Note #

• Subdomain Parsing: Adjust the domain part check to match your actual domain structure (e.g., if you have a 2-level TLD like co.uk, you’ll need to tweak domainParts.Length).
• Path Traversal Protection: The normalization check is non-negotiable—this stops malicious users from accessing files outside their own directory.
• User Entry Point: If your users might use a different entry file (like default.html), make this configurable per user instead of hardcoding index.html.
• Static File Handling: Ensure IIS is set up to serve static files from the rewritten paths. If you run into issues, add this to your web.config to override static file handling:

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
  </system.webServer>
  

3. Why This Beats the Error Handler Approach #

Your current Application_Error setup only triggers when a file isn’t found, which works for /index.html but misses edge cases (like virtual routes that should still load the user’s SPA). By handling requests upfront, you ensure every request—whether for a real attachment or a virtual path—lands in the correct user’s site context.

If you need to support user-specific routing logic (e.g., users uploading ASP.NET apps with their own routes), you could extend this to check for a web.config in the user’s directory and let their code take over, but that adds more complexity. For most static HTML/SPA sites, the above approach should cover it.

内容的提问来源于stack exchange，提问作者ikwillem