Referer 검사를 이용한 자동 로그인

<appSettings>
  <add key="EnableSsoUsingReferer" value="true" />
  <add key="SingleSignOnPassword" value="my-secret-key" />
  <add key="LoadableInFrame" value="true" />
</appSettings>

<allowed>
    <site>https://gw.tabslab.com</site>
</allowed>

using System.Security.Cryptography;

protected void Page_Load(object sender, EventArgs e)
{
    string loginMailAddr = "user@domain.com";
    string timestamp = DateTime.UtcNow.ToString("s");
    string signature = Sign(loginMailAddr + "|" + timestamp);
    string url = string.Format("https://mail.tabslab.com/External/Logon.ashx?User={0}&Timestamp={1}&Sign={2}", loginMailAddr, timestamp, signature);
    Response.Redirect(url);
}

private string Sign(string message)
{
    string secretKey = "my-secret-key";

    byte[] keyBytes = Encoding.UTF8.GetBytes(secretKey);
    byte[] messageBytes = Encoding.UTF8.GetBytes(message);

    // HMAC-SHA256 객체 생성
    using (var hmac = new HMACSHA256(keyBytes))
    {
        byte[] hashBytes = hmac.ComputeHash(messageBytes);
        return BitConverter.ToString(hashBytes).Replace("-", "").ToLower();
    }
}

protected void Page_Load(object sender, EventArgs e)
{
    string loginMailAddr = "user@domain.com";
    string timestamp = DateTime.UtcNow.ToString("s");
    string signature = Sign(loginMailAddr + "|" + timestamp);
    string gotoUrl = "/Board/Default.aspx";
    string url = string.Format("https://mail.tabslab.com/External/Logon.ashx?User={0}&Timestamp={1}&Sign={2}&Lang=ko&ReturnUrl={3}", loginMailAddr, timestamp, signature, Server.UrlEncode(gotoUrl));
    Response.Redirect(url);
}

<%
Dim loginMailAddr, utcTime, timestamp, signature, gotoUrl, param

loginMailAddr = "user@domain.com"
utcTime = DateAdd("h", -9, Now())
timestamp = GetIso8601Time(utcTime)
signature = Sign(loginMailAddr & "|" & timestamp)
param = "User=" & loginMailAddr & "&Timestamp=" & timestamp & "&Sign=" & signature

gotoUrl = Request("goto")
If gotoUrl <> "" Then
    param = param & "&ReturnUrl=" & Server.UrlEncode(gotoUrl)
End If

Response.Redirect "https://mail.tabslab.com/External/Logon.ashx?" & param

Function Sign(message)
    Dim sha256, secretKey
    secretKey = "my-secret-key"
    Set sha256 = GetObject("script:" & Server.MapPath("sha256.wsc"))
    sha256.hexcase = 0   '0 = 소문자 hex, 1 = 대문자 hex
    Sign = sha256.hex_hmac_sha256(secretKey, message)
End Function

Function GetIso8601Time(t)
    GetIso8601Time = CStr(Year(t)) & "-" & Right("0" & Month(t), 2) & "-" & Right("0" & Day(t), 2) & "T" &_
        Right("0" & Hour(t), 2) & ":" & Right("0" & Minute(t), 2) & ":" & Right("0" & Second(t), 2)
End Function
%>