Rails 中的匿名用户——安全考虑？
我正在考虑在 Rails 中实现某种形式的匿名用户系统。 我需要让人们做一些事情（创建记录、查看他们创建的内容等），而无需实际创建帐户。 一旦他们创建了帐户，一切都会持续存在，不会有因清除 cookie 或其他原因而丢失帐户的风险。
现在，我认为这非常简单。 在 User 模型中有一个 is_anonymous 字段，并使用类似的内容来访问当前登录的用户：
def find_user
session[:user_id] ||= create_new_anonymous_user.id
end
假设会话持续一段合理的时间，并且会话 cookie 不会过期，这应该使一切顺利运行。
然而，我内心深处确信我错过了一些与安全相关的东西。 以前有人做过这样的事情吗？ 我错过了一些非常明显的东西吗？
谢谢！
I'm looking at implementing some form of anonymous user system in Rails. I need to let people do things (creating records, looking at what they've created, etc), without actually creating an account. Once they create an account, everything persists without risk of losing it by clearing cookies or something.
Right now, I'm thinking it's pretty straightforward. Have an is_anonymous field in the User model, and use something like this to access the currently logged in user:
def find_user
session[:user_id] ||= create_new_anonymous_user.id
end
Assuming the session persists for some reasonable period of time, and the session cookie doesn't expire, that should keep everything running smoothly.
However, there is this piece of me that is convinced that I'm missing something security-related. Has anyone done something like this before? Am I missing something super-obvious?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
唯一真正的安全问题是这些匿名用户是否可以执行关键操作。
您的系统意味着拥有特定 cookie 的任何人都可以访问该网站。 不一定有什么大不了的，但这实际上取决于用户提供的信息类型。
我过去做过类似的事情（在我的例子中，我通过网站跟踪进度，当用户登录或注册时，我将“访客”数据附加到他们的帐户中。当您进行切换时，请确保删除匿名记录以防止进一步访问，应该没问题。
The only real security issue is going to be if these anonymous users can perform critical operations.
Your system means that anyone with the specific cookie will gain access to the site. Not necessarily a big deal, but it really depends on the type of information your users are providing.
I have done something similar in the past (in my case I was tracking progress through a site and when the user logged in or registered, I attached the "guest" data to their account. When you do the switch, make sure you delete the anonymous record to prevent further access and it should be fine.
我刚刚找到了一个使用 Authlogic 的“试用用户”的非常酷的示例： http://github.com/gisikw/authlogic_trial
I just found a pretty cool example of "trial users" using Authlogic: http://github.com/gisikw/authlogic_trial
也许您应该为新用户设置一个单独的长期 cookie，以便他们可以拥有多个会话（至少来自该浏览器）。
Perhaps you should set a separate long lived cookie for the new user, so they can have multiple sessions (at least from that browser).
您确定要让人们创建与可能不存在的帐户绑定的对象吗？ 不幸的是，我不太了解您的应用程序实际在做什么，但我认为走这条路可能会给您留下一堆不属于任何真正用户“拥有”的孤立对象。
如果你真的确实想要这样做，我认为你所拥有的已经很不错了。 您可以创建一个真实的用户，标记为“访客”（或其他），一旦用户想要真正注册，系统就会提示他们输入其他信息并取消标记。 您应该添加访客与非访客的访问控制等。
Are you sure that you want to let people create objects that are tied to accounts that may not exist? Unfortunately I don't know much about what your application is actually doing but I would think that going down this path might leave you with a bunch of orphaned objects not really "owned" by any real users.
If you really do want to do this I think what you have is decent. You could be creating a real user, flagged as "guest" (or whatever) and once the user wants to really register they are prompted for other information and unflagged. You should add access control for guest vs non-guest, etc.