从一个应用程序到另一应用程序的远程发布。 安全问题？
如果在一个应用程序中我们对另一个应用程序进行隐藏发布以利用该应用程序功能，是否会存在任何安全问题？
Is there any security issue if let say in one application we do a hidden post to another application to make use of that application functionality?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
依靠。 您是否使用某种身份验证和加密？
这可能会导致许多安全问题。 尽管你可以说许多实现都是如此。 大多数配置不当的东西都可能成为安全问题。
Depends. Are you using some sort of authentication and encryption?
There are ways this could cause many security issues. Though you could say that of many implementations. Most anything configured badly can be a security issue.
将其他应用程序的功能包装在 Web 服务中会更好。 这将为您提供一个小的隔离层，使其与被调用应用程序界面中的任何更改（例如表单主体中的其他元素）隔离。
也就是说，正如另一个答案中所述，身份验证和加密很重要。 但是，它并不比直接通过其 UI 使用其他应用程序更安全或更不安全。
编辑：至少有一种情况可能会导致新场景不如旧场景安全。 如果被调用的应用程序仅使用输入数据的客户端验证（坏主意），则在进行交叉发布时您将必须重复该验证。
It would be much better to wrap the other app's functionality in a web service. This will give you a small layer of isolation from any changes in the called app's interface (ex. additional elements within the form body).
That said, as stated in another answer, authentication and encryption are important. However, it won't really be more or less secure than just using the other app directly through its UI.
Edit: There is at least one situation which can lead to the new scenario being less secure than the old one. If the called app uses purely client-side validation of the input data (bad idea), you will have to duplicate that validation when doing the cross post.