ASP.NET MVC受保护的成员区域，URL中包含敏感数据 [英] ASP.NET MVC protected members area with sensitive data in URLs

问题描述

假定ASP.NET MVc应用程序具有受保护的成员区域.生成的某些URL包含敏感数据，例如Accounts/123、123是敏感数据(例如帐号).如果用户的计算机后来遭到入侵，攻击者将无法进入Accounts/123，因为这将受到保护，但是他们只是通过查看用户的浏览器历史记录就获得了用户的帐号.我唯一可以避免这种情况的方法是即使在受保护的区域中也不要使用URL中的敏感数据.

Assume an ASP.NET MVc application has a protected members area. Some URLs generated contain sensitive data, for example Accounts/123, 123 being the sensitive data such as an account number. If the users machine later got compromised the attacker could not get to Accounts/123 as this would be protected, but they we have obtained the users account number just by looking at their browser history. The only way I can see to avoid this is to not use sensitive data in the URL even in protected areas.

我在想一个场景，其中敏感数据是用于索引，详细信息，编辑的ID.一种解决方案是在表中添加一个表示敏感数据的字段，如果受到威胁，则没有任何意义，但可以使用在网址中.

I was thinking of scenerios where the sensitive data is the ID used for indexing, details, editing.. A solution could be to add another field to the table that represents the sensitive data, thats means nothing if compromised but can be used in the URL.

还是有另一种方法?

推荐答案

我会说不要在URL中使用敏感数据，并将帐号存储在用户会话中(如果假设有多个帐号，则仅保留当前).

I would say don't use sensitive data in the URL, and keep the account number stored in the users session (if assuming multiple account numbers, keep only the current).

编辑

看到您的修改后:

如果您确实想要一种安全的方法而客户端没有通过页面URL知道任何想法，请考虑这种情况.

If you really want a secure approach to this without the client having any idea via the URL of the page take this scenario into consideration.

• 用户有多个帐户
• 帐户在页面上列出
• 使用当前会话ID对帐户"ID"进行加密
• 用户单击链接，将其带到链接/Account/10912ljlkj2308s

现在您的帐户ID不再可见，并且加密密钥仅适用于该会话和该ID.授予的会话ID可能并不总是唯一的，但这对于历史记录/缓存中的查看者"而言将是巨大的威慑力量.

Now your account id's are no longer visible, and the encryption key is only good for that session and that ID. Granted session ID's may not always be unique, but this would be a huge deterrent for the "viewer" in the history/cache.

这篇关于ASP.NET MVC受保护的成员区域，URL中包含敏感数据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！