什么是基本的 ASP.NET 表单安全实践？
假设我有一个带有一些禁用复选框的表单，因为登录的用户不应该能够检查它们。 我应该在哪里添加一些消毒安全措施以确保他们不会破解复选框并导致回发？
在页面中？ 数据库层？ 在数据库中？
我意识到这很可能是一个非常广泛的问题。
谢谢， 标记
Assume I have a form with some disabled checkboxes because the user as logged in shouldn't be able to check them. Where should I add some sanitization security to make sure they didn't hack the checkbox and cause a postback?
In the page?
Database layer?
In the database?
I realize it's most likely a pretty broad question.
thanks,
Mark
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您确实需要确保其安全，请跨所有层实施检查……至少从数据库和数据访问层开始。
If you really need to make it secure, implement checks across all layers..at a minimum, start with the database and data access layer.
我更喜欢尽可能让用户无法交互的东西完全不可见。 你无法破解你看不到的东西（我的意思不是隐藏在页面上，我的意思是服务器不会为未登录用户看不到的东西生成代码）。
也就是说，假设您需要使控件保持可见但禁用，我将在前端和后端添加代码来进行检查。 前端验证代码很容易受到黑客攻击，但是为使用该系统的用户提供快速验证反馈是件好事 - 然而，后端应该是真正的故障安全位置，以确保一切都符合预期并在提交更改之前进行最终检查。
不幸的是，有时这意味着您需要重复工作，但对于真正重要的事情，这是值得的。
I prefer to make things the user can't interact with completely invisible when possible. You can't hack what you can't see (and I don't mean hidden on the page, I mean the server doesn't generate the code for the things not logged in users can't see).
That said, assuming you need to leave controls visible, but disabled, I would add code in both the front-end and the back-end to do checks. The front-end validation code is susceptible to hacking, but it is nice to have quick validation feedback available for users that are using the system - however, the back-end should be your real fail-safe place to make sure everything is as expected and do final checks before committing changes.
Unfortunately that sometimes means you need to duplicate the effort, but for really important stuff, it is worth it.
ASP.NET 事件验证机制负责处理这个问题。 我想它从 2.0 就已经存在了。
ASP.NET Event validation mechanism takes care of that. It's been there since 2.0, I think.