为什么加密查询字符串在ASP.NET？ [英] Why Encrypt Query Strings in ASP.NET?
问题描述
我的工作就是写在C＃/ ASP.NET的Web应用程序。该应用程序的原始制定者选择使用加密的查询字符串和视图状态来控制安全的应用程序和国家。
I work on a web-application that is written in C#/ASP.NET. The original framers of this application chose to use encrypted query strings and Viewstate to control the 'security' and 'state' of the application.
说完来自GET / POST世界在这之前，我并没有理解为什么人们会通过加密查询字符串，使用POST敏感数据（以及SSL）时的麻烦了良好的基础将实现类似的安全级别。
Having come from a GET/POST world before this, I don't have a good basis for understanding why people would go through the trouble of encrypting query strings, when using POST for sensitive data (along with SSL) would achieve a similar level of security.
我的问题是：什么是ASP.NET使用加密查询字符串的优势和劣势？是否有这样的记载最佳实践？
My question is: What are the advantages and disadvantages of using Encrypted Query Strings in ASP.NET? Is there a documented 'best practice' for this?
修改：人们往往把重点放在视图状态在这个问题上。 不要。视图状态只提到给你一个更好的主意，以确定'国家'是如何管理的，因为这是切向相关网址。我从来没有说过视图状态被加密。真的有两个问题：1）视图状态，并加密查询字符串2）使用中的应用。这个问题的重点是后者。我希望这有助于澄清问题的焦点。
Edit: People tend to focus on Viewstate in this question. Don't. Viewstate was mentioned only to give you a better idea to ascertain how 'state' was managed, since that is tangentially related to URLs. I never said Viewstate was encrypted. There really are two issues: 1) The Use of Viewstate, and 2) the Use of encrypted query strings. This question is focused on the latter. I hope that helps to clear up the focus of the question.
推荐答案
一个理由，你为什么会做这样的事情是prevent的URL篡改获得对数据的访问不是您自己。例如，如果你有网址：
A reason why you might do something like this is to prevent tampering with the URL to get access to data other than your own. For example, if you have the url:
http://foo.com/user.aspx?user_id=123
这不会是很难，我（或任何人）更改为：
it wouldn't be hard for me (or anyone) to change that to:
http://foo.com/user.aspx?user_id=124
如果您的数据访问策略完全依靠什么在查询字符串，这可能允许未经授权的数据访问。
If your data access strategy relies entirely on what's in the querystring, that could allow unauthorized access to data.
此方法确实正确地达到这一目的，而是一种更强大的方式来获得有积极的应用程序中查看的授权，从不一味依赖URL进行身份验证和/或授权。
This approach does serve that purpose correctly, but a more robust way to get there is to actively check authorization within the application, and never rely exclusively on the URL for authentication and / or authorization purposes.
请注意，这已经无关，与SSL - 确保浏览器和服务器之间的私密性，但你可以在一个非常安全的连接，仍然篡改网址
Note that this has nothing to do with SSL - that ensures privacy between the browser and server, but you can be under a perfectly secure connection and still tamper with the URL.
这篇关于为什么加密查询字符串在ASP.NET？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
