您的位置: 首页  >  技术问答  >  这个AJAX场景中最好的安全指南是什么，特别关注身份验证？

这个AJAX场景中最好的安全指南是什么，特别关注身份验证？

分类: 技术问答 • 2022-02-28 16:29:08

这个AJAX场景中最好的安全指南是什么，特别关注身份验证？

问题描述：

[I hope that this question is not too broad, I think that the subject is very interesting but I incourage you to tell me if it's off-policy.]

My scenario is this:

  • I have a LAMP website who stores also sensitive data and documents
  • Only registered users are allowed to operate on the site, and only on certain data and documents. Users are stored in $_SESSION variables
  • Most of the pages implement a sort of rudimental permission control, but some important DB operations are called via AJAX
  • AJAX security is implemented very poorly, as anyone that is that smart can tamper with the request sending whatever id they like and delete records with brutal simplicity

Asking for a complete book on security is obviously a bit too much (and I'm already reading and trying a lot on the subject), let's say that my main concern is if AJAX pages should be treated with special regards, as I need to secure the whole software to prevent hacks and other problems.

[我希望这个问题不是太宽泛，我认为主题是非常 em >有意思，但我不鼓励你告诉我它是不是政策。] p>

我的情况是这样的： p>

  • 我有 li>
  • 只有注册用户才能在网站上操作，并且只能在某些数据和文档上运行.LAMP网站也会存储敏感数据和文档。 用户存储在$ _SESSION变量中 li>
  • 大多数页面实现了一种基本的权限控制，但是通过AJAX调用了一些重要的数据库操作 li>
  • 实现了AJAX安全性 非常糟糕，任何聪明的人都可以篡改发送他们喜欢的任何ID的请求并删除简单残缺的记录 li> ul>

    要求完整的安全书是 显然有点太多了（而且我已经在阅读并尝试了很多这个主题），让我们说我的主要关注点是AJAX页面是否应该得到特别的关注，因为我需要保护整个软件以防止黑客入侵 其他问题。 p> div>

答

I have a LAMP website who stores also sensitive data and documents

You should store as little sensitive data as possible. Especially when you are not sure how to keep this information secure/private. Use OpenID or something for your authentication for example. I really like LightOpenID for it's simplicity. I created a little example project/library to see lightopenId in use. It simplifies using OpenID by using openID-selector. When you use OpenID you also use secure OpenID providers the passwords are also not transmitted over the wire in plain-text but protected by https/SSL.

Only registered users are allowed to operate on the site, and only on certain data and documents. Users are stored in $_SESSION variables

Yup that's what sessions are for.

Most of the pages implement a sort of rudimental permission control, but some important DB operations are called via AJAX

You should read up on OWASP top 10. at least. (Don’t stop at 10.)

AJAX security is implemented very poorly, as anyone that is that smart can tamper with the request sending whatever id they like and delete records with brutal simplicity

See previous section. Read up on OWASP top 10 section at least. Somethings which a lot of people overlook for example are CSRF for example.

答

let's say that my main concern is if AJAX pages should be treated with special regards

Not really. They should be treated almost exactly the same as any other request. All HTTP requests come from outside your system and are under the control of the client (so can consist of, more or less, anything the user can imagine).

You might be returning JSON, you might be returning a complete HTML document, you might be returning XML — but the format doesn't matter, the data does.

If the request is for sensitive data, then you need (on the server) to authenticate the user and then make sure they are authorised to view / edit that data.

The only difference is how you present a "You are not authorised" message. You can't simply return an HTML document with a login form when you expect the browser to load data into XHR. The response needs to be appropriately formatted and the JavaScript needs to be able to handle it.

相关推荐