如何拒绝直接访问AJAX目录中的文件

问题描述：

I have several pages that call in content via jQuery .ajax. I dont want the content visible on the page so thats why I went with .ajax and not showing/hiding the content. I want to protect the files inside the AJAX directory from being directly accessible through the browser url. I know that PHP headers can be spoofed and dont know if it is better to use an "access" key or try doing it via htaccess.

My question is what is the more reliable method? There is no logged on/non logged user status, and the main pages need to be able to pull in content from the pages in the AJAX directories.

thx

我有几个页面通过jQuery .ajax调用内容。我不希望页面上显示内容，这就是为什么我使用.ajax而不显示/隐藏内容的原因。我想保护AJAX目录中的文件不能通过浏览器URL直接访问。我知道PHP标头可能是欺骗性的，不知道是否更好地使用“访问”键或尝试通过htaccess进行操作。 p>

我的问题是什么是更可靠的方法？没有登录/未登录的用户状态，主页需要能够从AJAX目录中的页面中提取内容。 p>

thx p>

答

Make a temporary time-coded session variable. Check the variable in the php output file before echoing the data.

OR, if you don't want to use sessions.. do this:

$key = base64encode(time().'abcd');

in the read file: base64decode explode by abcd read the time. Allow 5 seconds buffer. If the time falls within 5 seconds of the stamped request. You are legit.

To make it more secure, you can change your encrypting / decrypting mechanism.

答

Why not have the content be outside the webserver directory, and then have a php script that can validate if the person should see it, and then send it to them.

So, you have getcontent.php, and you can look at a cookie, or a token that was given to the javascript page and it uses to do the request, and then it will just fetch the real content, set the mime types and stream it to the user.

This way you can change your logic as to who should have access, without changing any of the rest of your application.

There is no real difference to having http://someorg.net/myimage.gif and http://someorg.net/myscript.php?token=887799&img_id=ddtw88 to the browser, but obviously it will need to work with GET so a time limited value is necessary as the user can see reuse it.

答

I would drop this idea because there is no secure way to do it.

Your server will never be able to tell apart a "real" Ajax request from a "faked" one, as every aspect of the request can be forged on client side. An attacker will just have to look into a packet filter to see what requests your page makes. It is trivial to replicate the requests.

Any solution you work out will do nothing but provide a false sense of security. If you have data you need to keep secret, you will need to employ some more efficient protection like authentication.

如何拒绝直接访问AJAX目录中的文件

相关推荐