LINE Pay款流程： 
reserve Page(紅科) 發送 reserve API => 取得 payment URL => 轉址到 payment URL => LINE Pay 檢查USER狀態 => 轉回confirm page(紅科), 發送 confirm API => DOWN.

付款需要程式： 
reserve API, confirm API:

send request JSON and read return JSON:
C#: 

using System.Net;

using System.IO;



public partial class TEST : System.Web.UI.Page

{

    DB.OrderMain oOrderObj = null;

    protected void Page_Load(object sender, EventArgs e)

    {

        //Setting request header

        HttpWebRequest httpWebRequest = (HttpWebRequest)WebRequest.Create("__APIRootURL__");

        httpWebRequest.ContentType = "application/json; charset=UTF-8";

        httpWebRequest.Method = "POST";

        httpWebRequest.Headers.Add("X-LINE-ChannelId", DB.SysConfig.LINEPay.ChannelId);

        httpWebRequest.Headers.Add("X-LINE-ChannelSecret", DB.SysConfig.LINEPay.SecretKey);



        //加入參數

        using (var streamWriter = new StreamWriter(httpWebRequest.GetRequestStream()))

        {

            string requestJSON = "{\"productName\": \"" + DB.SysConfig.SYSTEM_NAME + "\"," +

                                "\"productImageUrl\": \"" + DB.SysConfig.URL_Shopping + "images/Logo.jpg\"," +

                                "\"amount\": " + oOrderObj.TotalAmount() + "," +

                                "\"currency\": \"TWD\"," +

                                "\"orderId\": \"" + oOrderObj.DisplayOrderId + "\"," +

                                "\"confirmUrl\": \"" + DB.SysConfig.URL_Shopping + "Handler/LinePay/GotoComfirm.aspx?Id=" + oOrderObj.Id + "\"," +

                                "\"cancelUrl\": \"" + DB.SysConfig.URL_Shopping + "Shopping/OrderComplete.aspx?Id=" + oOrderObj.Id + "\"," +

                                "\"capture\": \"true\"," +

                                "\"confirmUrlType\": \"CLIENT\"}";



            streamWriter.Write(requestJSON);

            streamWriter.Flush();

            streamWriter.Close();

        }



        //取得回覆資訊

        var httpResponse = (HttpWebResponse)httpWebRequest.GetResponse();

        //解讀回覆資訊

        using (var streamReader = new StreamReader(httpResponse.GetResponseStream()))

        {

            var responseJSON = streamReader.ReadToEnd();

            //將 JSON 轉為物件

            GN.LinePay.reserveRes.ReturnJSON oReturnObj = (GN.LinePay.reserveRes.ReturnJSON)Newtonsoft.Json.JsonConvert.DeserializeObject(responseJSON, typeof(GN.LinePay.reserveRes.ReturnJSON));



            if (oReturnObj.returnCode == "0000")

            {

                //成功

            }

            else

            {

                //失敗

                string ErrMsg = "Error Code: " + oReturnObj.returnCode + "\r\n" + oReturnObj.returnMessage;

            }

        }

    }

}

.vb

Imports System.Net

Imports System.IO



Partial Class TEST

    Inherits System.Web.UI.Page



    Dim oOrderObj As DB.OrderMain

    Private Sub Admin_TEST_Load(sender As Object, e As EventArgs) Handles Me.Load

        'Setting request header

        Dim httpWebRequest As HttpWebRequest = WebRequest.Create("__APIRootURL__")

        httpWebRequest.ContentType = "application/json; charset=UTF-8"

        httpWebRequest.Method = "POST"

        httpWebRequest.Headers.Add("X-LINE-ChannelId", DB.SysConfig.LINEPay.ChannelId)

        httpWebRequest.Headers.Add("X-LINE-ChannelSecret", DB.SysConfig.LINEPay.SecretKey)

        '加入參數

        Using streamWriter As New StreamWriter(httpWebRequest.GetRequestStream())

            Dim requestJSON As String = "{""productName"": """ + DB.SysConfig.SYSTEM_NAME + """," +

                                        """productImageUrl"": """ + DB.SysConfig.URL_Shopping + "images/Logo.jpg""," +

                                        """amount"": " + oOrderObj.TotalAmount() + "," +

                                        """currency"": ""TWD""," +

                                        """orderId"": """ + oOrderObj.DisplayOrderId + """," +

                                        """confirmUrl"": """ + DB.SysConfig.URL_Shopping + "Handler/LinePay/GotoComfirm.aspx?Id=" + oOrderObj.Id + """," +

                                        """cancelUrl"": """ + DB.SysConfig.URL_Shopping + "Shopping/OrderComplete.aspx?Id=" + oOrderObj.Id + """," +

                                        """capture"": ""true""," +

                                        """confirmUrlType"": ""CLIENT""}"



            streamWriter.Write(requestJSON)

            streamWriter.Flush()

            streamWriter.Close()

        End Using

        '取得回覆資訊

        Dim httpResponse As HttpWebResponse = httpWebRequest.GetResponse

        '解讀回覆資訊

        Using streamReader As New StreamReader(httpResponse.GetResponseStream())

            Dim responseJSON As String = streamReader.ReadToEnd()

            '將 JSON 轉為物件

            Dim oReturnObj As GN.LinePay.reserveRes.ReturnJSON = Newtonsoft.Json.JsonConvert.DeserializeObject(responseJSON, GetType(GN.LinePay.reserveRes.ReturnJSON))



            Dim ResMsg As String = ""

            If oReturnObj.returnCode = "0000" Then

                '成功



            Else

                '失敗

            End If

        End Using

    End Sub

End Class

工具網站：
JSON 轉物件 http://json2csharp.com/
C# to VB : http://converter.telerik.com/



#專案： 紅科

Post 的資料好像會變大, 要改 Web.config

<system.web>

    <httpRuntime requestValidationMode="2.0" maxRequestLength="1024000"/>

</system.web>

程式碼如下:

public string UploadFilesToRemoteUrl(string url, string[] files, NameValueCollection formFields = null)

    {

        string boundary = "----------------------------" + DateTime.Now.Ticks.ToString("x");



        HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);

        request.ContentType = "multipart/form-data; boundary=" +

                                boundary;

        request.Method = "POST";

        request.KeepAlive = true;



        Stream memStream = new System.IO.MemoryStream();



        var boundarybytes = System.Text.Encoding.ASCII.GetBytes("\r\n--" +

                                                                boundary + "\r\n");

        var endBoundaryBytes = System.Text.Encoding.ASCII.GetBytes("\r\n--" +

                                                                    boundary + "--");





        string formdataTemplate = "\r\n--" + boundary +

                                    "\r\nContent-Disposition: form-data; name=\"{0}\";\r\n\r\n{1}";



        if (formFields != null)

        {

            foreach (string key in formFields.Keys)

            {

                string formitem = string.Format(formdataTemplate, key, formFields[key]);

                byte[] formitembytes = System.Text.Encoding.UTF8.GetBytes(formitem);

                memStream.Write(formitembytes, 0, formitembytes.Length);

            }

        }



        string headerTemplate =

            "Content-Disposition: form-data; name=\"{0}\"; filename=\"{1}\"\r\n" +

            "Content-Type: application/octet-stream\r\n\r\n";



        for (int i = 0; i < files.Length; i++)

        {

            memStream.Write(boundarybytes, 0, boundarybytes.Length);

            var header = string.Format(headerTemplate, "uplTheFile", files[i]);

            var headerbytes = System.Text.Encoding.UTF8.GetBytes(header);



            memStream.Write(headerbytes, 0, headerbytes.Length);



            using (var fileStream = new FileStream(files[i], FileMode.Open, FileAccess.Read))

            {

                var buffer = new byte[1024];

                var bytesRead = 0;

                while ((bytesRead = fileStream.Read(buffer, 0, buffer.Length)) != 0)

                {

                    Response.Write("bytesRead: " + bytesRead.ToString() + "<br>");

                    memStream.Write(buffer, 0, bytesRead);

                }

            }

        }



        memStream.Write(endBoundaryBytes, 0, endBoundaryBytes.Length);

        request.ContentLength = memStream.Length;



        using (Stream requestStream = request.GetRequestStream())

        {

            memStream.Position = 0;

            byte[] tempBuffer = new byte[memStream.Length];

            memStream.Read(tempBuffer, 0, tempBuffer.Length);

            memStream.Close();

            requestStream.Write(tempBuffer, 0, tempBuffer.Length);

        }



        try

        {

            using (var response = request.GetResponse())

            {

                Stream stream2 = response.GetResponseStream();

                StreamReader reader2 = new StreamReader(stream2);

                return reader2.ReadToEnd();

            }

        }

        catch (Exception ex)

        {

            return (ex.ToString());

            throw;

        }

    }

客戶要求
1. 檔案只能放在 Firewall 內的後台用 Web server (Server A).
2. 使用者只能存取 DMZ 的 Web server (Server B).
3. Server B 只能用 HTTP 通過 Firewall 向 Server A 要資料.(i.e.  Server B 不能掛戴 Server A 的目錄成為虛擬目錄)

所以在 Server B 上面建立了一支程式用 HTTP 的方式讀取 Server A 的檔案再寫出去.

例如, http://ServerB/Upload/test.pdf 會讀取 http://ServerA/Upload/test.pdf 再送到 Client 端

namespace WWW.Controllers

{

    public class UploadController : Controller

    {

        // GET: Upload

        public void Index(string Filename)

        {

            //Create a stream for the file

            Stream stream = null;



            //This controls how many bytes to read at a time and send to the client

            int bytesToRead = 10000;



            // Buffer to read bytes in chunk size specified above

            byte[] buffer = new Byte[bytesToRead];



            string url = "http://admin-dev.nanya.bike.idv.tw/newnanyaback/Upload/" + Filename;



            // The number of bytes read

            try

            {

                //Create a WebRequest to get the file

                HttpWebRequest fileReq = (HttpWebRequest)HttpWebRequest.Create(url);



                //Create a response for this request

                HttpWebResponse fileResp = (HttpWebResponse)fileReq.GetResponse();



                if (fileReq.ContentLength > 0)

                    fileResp.ContentLength = fileReq.ContentLength;



                //Get the Stream returned from the response

                stream = fileResp.GetResponseStream();



                // prepare the response to the client. resp is the client Response

                var resp = HttpContext.Response;



                if (Filename.ToLower().EndsWith(".png") ||

                    Filename.ToLower().EndsWith(".jpg") ||

                    Filename.ToLower().EndsWith(".jpeg") ||

                    Filename.ToLower().EndsWith(".gif")

                    )

                {

                    resp.ContentType = "image";

                }

                else

                {

                    //Indicate the type of data being sent

                    resp.ContentType = "application/octet-stream";



                    //Name the file

                    resp.AddHeader("Content-Disposition", "attachment; filename=\"" + HttpUtility.UrlEncode(Filename, Encoding.UTF8) + "\"");

                }



                resp.AddHeader("Content-Length", fileResp.ContentLength.ToString());



                int length;

                do

                {

                    // Verify that the client is connected.

                    if (resp.IsClientConnected)

                    {

                        // Read data into the buffer.

                        length = stream.Read(buffer, 0, bytesToRead);



                        // and write it out to the response's output stream

                        resp.OutputStream.Write(buffer, 0, length);



                        // Flush the data

                        resp.Flush();



                        //Clear the buffer

                        buffer = new Byte[bytesToRead];

                    }

                    else

                    {

                        // cancel the download if client has disconnected

                        length = -1;

                    }

                } while (length > 0); //Repeat until no data is read

            }

            finally

            {

                if (stream != null)

                {

                    //Close the input stream

                    stream.Close();

                }

            }

        }

    }

}

但不是這樣就好了, 在 RouteConfig.cs 中要加上:
            routes.MapRoute(
                name: "Upload",
                url: "Upload/{filename}",
                defaults: new { controller = "Upload", action = "Index", filename = UrlParameter.Optional }
            );

此外在 Web.Config 中也要加上:

  <system.webServer>
    <handlers>
      <add name="UrlRoutingHandler_Upload"
           type="System.Web.Routing.UrlRoutingHandler, 
               System.Web, Version=4.0.0.0, 
               Culture=neutral, 
               PublicKeyToken=b03f5f7f11d50a3a"
           path="/Upload/*"
           verb="GET"/>
    </handlers>
  </system.webServer>

參考:
http://stackoverflow.com/questions/5596747/download-stream-file-from-url-asp-net

http://blog.darkthread.net/post-2014-12-05-mvc-routing-for-url-with-filename.aspx

在 windows  2008 的 IIS7 跑 MVC, 會遇到 Application_BeginRequest 沒有作用, 可以在 web.config 中加一個:

<system.webServer>
  <modules runAllManagedModulesForAllRequests="true" />
</system.webServer>

另外聽說裝 KB980368 會是比較好的解決方法, 有空再來試試.

參考: http://blog.darkthread.net/post-2015-05-30-aspnet-mvc-on-win2008.aspx

目前習慣是把後台的認証是做在 Master Page 裡面,

另外發現一個可以做登入檢查的地方:

lobal.asax 裡的 "Application_AcquireRequestState" 這個會發生在 Page_PreInit 之前, 而且可以使用 Session 變數. 也可以抓到所有的 Cookie.

不過剛發現一個情況, / 的 request 會執行

Application_BeginRequest
Application_AuthenticateRequest
Application_AuthorizeRequest
Application_ResolveRequestCache
Application_AcquireRequestState
Application_PreRequestHandlerExecute

兩次,

而且第一次是沒有 Session 的.. 

還要再研究....
 

錯誤訊息如下, 完全沒有錯誤訊息, 以及沒有錯誤的程式碼位置

 <Item time="2016-01-11T05:39:01" page="/fr/iconic-bright-cushion-spf-50-pa-nude-perfection-compact-foundation/p/5490/c/30"

url="http://www.shopunt.com/fr/iconic-bright-cushion-spf-50-pa-nude-perfection-compact-foundation/p/5490/c/30?utm_source=edm&amp;utm_medium=email&amp;utm_content=20160107_cushion_4&amp;utm_campaign=makeup&amp;OutAD_Id=5825" username="Not Member" browserName="Chrome" browserVersion="34.0" userAgent="Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-N915FY Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36" RemoteIP="37.160.206.7" Ref="No Ref" RequestType="GET" Ver="3">

    <ErrMsg>

    </ErrMsg>

    <ErrStack> 於 System.Web.CachedPathData.ValidatePath(String physicalPath)

於 System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)</ErrStack>

    <Post>

    </Post>

    <Cookie>

    </Cookie>

</Item>

查了一下，原來網址後面多了空白 (%20) , 也就是 ? 前面多了空白
只是exception物件會自作聰明把他濾掉了，反而從 exception log 看不到資料
測試過，userd可以正常看網站，只是server會有不斷 excetion產生，有點煩
網路上雖有一些解法，但我想還是要求下廣告時，要注意網址問題


 

對於網頁加速的問題，已經被廣泛的討論了
主要在於減少 request 數以及減低網路傳輸的時間
也因此發展出一些技巧或技術，例如 css sprite, 資料gzip 等
瀏覽器也把連線數限制從2條變成6條，以加快網頁顯示的速度
然而若要網頁能有本質上的提升，則是該把 HTTP 這個老通訊協定升級了
(目前是HTTP/1.1, 1999年)

由Google Chrome推廣的 SPDY 標準，已經改良並訂為 HTTP/2 的標準 (2015年初定案)
他的重點在於 (如果我理解得沒錯的話，歡迎指正)
1. http header 也可壓縮 (HTTP1.1 header 無法壓縮)
2. 一個 connection 可以傳輸多個Content (HTTP1.1 一個request 一個 content)
3. 可以 Server Push 資料
4. 可以向下相容 1.1
實測上，可以讓網頁載入速度提升約 30%

目前，大部分瀏覽器已經支援 HTTP/2 標準，然而 Server 端的步調就緩慢許多
微軟的 IIS 要到 10 才支援，目前只有 windows 10 才有
Windows Server則要明年 2016 才有支援
相反於微軟，其他非微軟的開發速度上就快多了 例如 Node.js

---------------------------------------------------------
測試上，可以用 Chrome 的開發模式 把 protocol 欄位勾選顯示



h2 就是 http/2

有個排程會超過 900 秒，結果發現每天跑 20 次

原因是 wget 預設超過 900秒無回應，會再發一次 request，預設會試 20次
所以遇到會跑超過15分鐘的排程，要加上以下參數
-t1  或是 --tries=1  讓排程只跑一次

昨晚突然出現大量的Exception，發現是某個IP攻擊網站，所以就直接使用IIS擋IP方式阻擋該IP的攻擊，但是設定之後，發現Exception還是一直出來。但是束手無策....直到一個多小時後才停止攻擊。

事後翻出IIS Log看結果



發現IIS擋IP有發揮作用(status:403) 但是會有漏網之魚(status:302-其實status是500)
檢查 "23:10:46" 一秒內受到 36 次攻擊 但是漏掉了 8 個 -> 失敗率約兩成

結論:
1. 對於阻斷攻擊，可能還需要程式上做處理，例如 begin_request 時檢查
2. Log Parser 真是看 log 最佳工具....

自從網站上了 net4.0 之後，網站會有為數不少的 "潛在危險" 的 exception
大都來自不友善的攻擊，想要測試網站的漏洞
網站做這層防護是好事，只是這個東西太敏感了，連簡單的冒號 & 符號都會跳 exception
更慘的是 Google Analytics 會在一些 user cookies 寫入xml文字 ( __utmz=... )
導致正常的 User 都不能正常瀏覽我們網站

解法有兩種:
1. 直接在 web.config 直接設定 不檢查

<system.web>

    <httpRuntime requestValidationMode="2.0" />

    <pages validateRequest="false" />

</system.web>

2. 自訂 RequestValidate (4.0以上才可以用)
請參考此文章 http://msdn.microsoft.com/en-us/library/system.web.util.requestvalidator(v=vs.100).aspx

後者比較算是正解 基本上處理掉 <script 我想 XSS 就解決一大半