是否可以在没有 https 服务器的情况下拥有安全的 Web 表单？
我有一个托管在提供商上的网站，该提供商没有为我提供固定 IP 地址，因此我无法使用 https。 我想使用网络表单但以安全的方式编辑一些页面。
客户端将是 iPhone 类型的设备，因此 java 或 flash 小程序将是不可能的。
- 有没有办法仅使用浏览器中的 javascript 在服务器和浏览器之间建立安全连接？
服务器上的语言当前是 php，但也可以是 ruby、python、perl 或 lua。
I have a website hosted on a provider which doesn't give me with a fixed ip adress so I cannot use https. I would like to edit some page using a webform but in a secure fashion.
The client would be an iphone type device, so a java or flash applet would be out of the question.
- Is there a way to still have a secure connection between the server and the browser using only javascript in the browser ?
The language on the server is currently php but it could be ruby, python , perl or lua.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
从技术上讲，安装 SSL 证书并不需要固定的 IP 地址 - SSL 证书与主机名（公用名）绑定。 我们经常更改主机上的 IP 地址，但从未更改与证书相关的任何内容。
也就是说，您确实可以使用 JavaScript 等，但这并不是一个真正好的解决方案 - 它总是听起来像黑客。
Installing a SSL certificate doesn't technically require a fixed IP address - the SSL certificate is tied to the host name (common name). We have often changed IP addresses on our hosts and never changed anything related to the certificates.
That said, you could indeed use JavaScript or the like, but it's not really a nice solution - it'll always smell like a hack.
您可以使用某种形式的 用 javascript 实现的公钥加密：
这将防止任何人在网络上嗅探您的敏感信息，但不能提供任何针对人为保护的保护-中间攻击。 SSL 使得此类攻击的实施变得更加困难，但并非不可能。
You could use some form of public key encryption implemented in javascript:
The would prevent anyone from sniffing your sensitive info on the wire, but doesn't provide any protection against a man-in-the-middle attack. SSL makes such an attack a little trickier to pull off, but not impossible.
不是传统意义上的，但是有一些选择：
获得更好的托管。 您可以每月花 20 美元购买具有固定 IP 的 VPS。 证书每年30美元。 对于需要安全性的人来说相当便宜。
您可以使用 JavaScript 和 PGP 加密表单数据。 这很便宜（并且它会给您的用户带来好处），但它应该可以保证您的数据足够安全。
可能有第三方允许通过他们的服务器（并通过扩展）他们的证书提交表单。 不过，您和您的用户必须相信他们不会滥用数据。
Not in the traditional sense, no but there are a few options:
Get better hosting. You could have a VPS with a fixed IP for $20/month. Certificate for $30 a year. Fairly cheap for people that need the security.
You could encrypt the form data using javascript and PGP. This is cheap (and it'll look it to your users) but it should keep your data safe enough.
There might be third parties out there that allow for form submission through their servers (and by extension) their certificates. You and your users would have to trust them not to abuse the data though.
理论上，您可以使用 Javascript 和 XmlHttpRequest 在客户端和服务器之间实现某种安全通信。 在实践中，这听起来像是一项繁重的工作，而且快速且真正安全的机会似乎很低。
正如 Alex 上面所说，即使您设法用 JS 实现，您仍然必须通过不安全的连接将 JS 提供给客户端，因此这一切都毫无意义。
尽管如此，更疯狂的事情之前已经在 Javascript 中实现过......
In theory you could implement some sort of secure communication between the client and server using Javascript and XmlHttpRequests. In practice it sounds like a lot of work and the chances of it being fast and truely secure seem low.
As Alex says above though, even if you managed to implement in JS, you'd still have to serve the JS to the client over an insecure connection, therefore making it all fairly pointless.
Still, crazier things have been implemented in Javascript before...
我想说答案是否定的。 原因是如果没有 https，所有流量都是未加密的纯文本。 因此，任何人都可以读取客户端的任何加密算法或密钥交换。 但我可能是错的......我从未尝试过。
I would say the answer is no. The reason being is that without https, all traffic is unencrypted plain text. Therefore, any encryption algorithm or key exchange on the client side would be readable by anyone. I could be wrong though...I've never tried it.
理论上这是可能的，只要您可以控制客户端并且（例如）那里有可信的 javascript（不是从服务器下载的）。 我可以详细说明，但与使用 https 相比，这些行中的任何内容都是 PITA 并且容易出错。
另外，也不需要有固定的IP——你有域名吗？
It is theoretically possible, provided you can control the client and (for example) have trusted javascript there which is not downloaded from the server. I could elaborate but anything on these lines is a PITA and error prone compared to using https.
Also it should not be necessary to have a fixed IP - do you have a domain name?
怎样才能使用Javascript呢？ 为了让浏览器执行 JavaScript，它必须首先从（前面提到的）不安全的服务器下载它。 HTTPS是一个服务器/客户端协议，所以如果你不能用服务器本身实现，你就根本无法实现它。
HTTPS 所需要的只是一个 IP 地址，因此即使它发生变化也没关系。 您应该能够使用具有动态 IP 的 HTTPS，但您可能需要与您的托管服务商联系。 如果您的主机位于共享服务器上，那么它将无法工作，您将需要专用 IP。 它们并没有那么贵，所以也许你应该每月花 3/4 美元？
亚历克斯
How would it be possible to use Javascript? In order for the browser to execute the javascript, it would have to first download it from the (previously stated) insecure server. HTTPS is a server/client protocol, so if you can't implement with the server itself, you won't be able to implement it at all.
All you need for HTTPS is a single IP address, so it wouldn't matter if it changed. You should be able to use HTTPS with a dynamic IP, but you might need to talk to your hoster. If your hosting is on a shared server, then it won't work and you'll need a dedicated IP. They aren't that expensive, so maybe you should just shell out the $3/4 a month?
Alex
SSL 是根据域名而不是 IP 地址进行操作的。 只要您拥有域名，并且有提供商愿意打开端口 443 并安装您为站点购买的证书，您就可以使用 HTTPS。
话虽这么说，假设您做不到，请查看 SRP：
来自该网站：“SRP 是一种基于密码的安全身份验证和密钥交换协议，它解决了安全地向服务器验证客户端的问题...此外，SRP 会交换加密强度高的秘密，作为成功身份验证的副产品，使双方能够安全地进行通信。 ”。
他们有 Javascript 示例。 您可以使用副产品通过网络加密数据。
然而，像大多数海报一样，您可能最好转向新的提供商。
SSL operates off the domain name, not an IP address. As long as you have and own a domain name, and have a provider willing to open port 443 and install the certificate you purchase for your site, you can do HTTPS.
That being said, assuming you can't do it, look into SRP:
From the site:"SRP is a secure password-based authentication and key-exchange protocol. It solves the problem of authenticating clients to servers securely...In addition, SRP exchanges a cryptographically-strong secret as a byproduct of successful authentication, which enables the two parties to communicate securely."
They have a Javascript examples. You'd use the byproduct to encrypt the data over the wire.
However, like most posters, you'd probably be better off moving to a new provider.
差不多两年过去了，现在 JavaScript 中有一个开源 SSL/TLS 实现。 然而，它目前依赖 Flash 提供原始套接字访问...所以除非应用程序要在 Android 手机而不是 iPhone 上运行，否则它可能没有那么有用。
http://github.com/digitalbazaar/forge/blob/master/README
It's almost 2 years later, but there's an opensource SSL/TLS implementation in JavaScript now. However, it currently relies on Flash to provide raw socket access... so unless the application is going to run on an android phone rather than an iphone, it might not be all that helpful.
http://github.com/digitalbazaar/forge/blob/master/README
是的。 您可以使用 私人表单 中的嵌入式表单（使用 PGP 加密）。
Private Forms 是一种 SaaS，它在将数据发送到服务器之前对客户端的 Web 表单数据进行加密。 然后，该加密数据将发送给您。 所有数据均使用您的 PGP 公钥进行加密，只有您可以使用您的 PGP 私钥对其进行解密。
因此，填写表格的人知道它是“安全的”，但他们不需要熟悉细节（例如生成密钥等）。
Yes. You can use an embedded form, using PGP encryption, from Private Forms.
Private Forms is SaaS that encrypts web form data client-side before sending the data to the server. Then, this encrypted data is sent to the you. All data is encrypted using your PGP public key, which only you can decrypt using your PGP private key.
So, the person filling out the forms knows it's "secure", but they don't need to be familiar with the details (like generating keys, etc).