ServerXMLHTTP 安全吗？
我们一直在使用 ServerXMLHTTP 发送 https POST 进行信用卡处理。 最近，我们的一位用户遇到了一个问题，导致错误“Microsoft Windows HTTP 服务中发生内部错误”。 通过更新IE解决了该问题。 现在，用户声称我们使用“internet explorer dll”存在安全问题。 当然，我知道问题出在 MS XML 核心服务上。 所以我的问题是...使用 MS XML Core Services（尤其是 ServerXMLHTTP 对象发送 https POST）是否安全？
We have been using ServerXMLHTTP to send https POST's for credit card processing. Recently one of our users experienced a problem resulting in the error "An internal error occurred in the Microsoft Windows HTTP Services". The problem was resolved by updating IE. Now the user is claiming that our use of "internet explorer dll's" is a security problem. Of course, I know that the issue is with the MS XML Core Services. So my question is...is it safe to use MS XML Core Services, particularly the ServerXMLHTTP object to send https POST's?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
尽管我不喜欢这样的事情，但由于您正在处理用户的信用卡，因此建议拒绝他们在过时的浏览器上提交信息。 这将防止将来出现此类情况，帮助保护您免受可能的诉讼，并具有保护您的用户、您的网站和其他人的额外好处。
根据我几年的 IT 工作经验，保护您的计算机最就是保持其最新状态 - 甚至比防病毒或防火墙保护重要得多*。
*显然，它们仍然非常重要，请不要误会我的意思。
As much as I dislike such things, since you're dealing with user's credit card, it might be advisable to deny them from submitting their information on too-outdated browsers. This will prevent such senarios in the future, helping to protect you from possible litigation, and has the added benefit of protecting your users, on your site and others.
In my experience working IT for a few years, the biggest thing you can do to protect your computer is to keep it up to date - far more important even than antivirus or firewall protection*.
*Obviously, they're still very important, don't get me wrong.
ServerXMLHTTP 使用 WinHTTP（不是 IE dll），而 SSL 又使用 Windows 服务来创建安全套接字。 您可能还会问“Windows 安全套接字安全吗？”。 我不确定其他浏览器中的网络堆栈代码到底能到达多远，但我怀疑其中许多浏览器仍然依赖底层操作系统来提供这种级别的服务。
安全吗？ 当然，答案“是”会引出并非如此的故事或例子。 它是否足够安全（条件是客户端计算机本身没有以某种方式受到损害）？ 是的。
ServerXMLHTTP uses WinHTTP (not an IE dll) which for SSL in turn uses Windows services to create a Secure socket. You may as well be asking "Are windows Secure sockets safe?". I'm not sure exactly how far down the network stack code in other browsers reach but I suspect many of them still rely on the underlying operating system for this level of service.
Is it safe? Of course the answer "yes" will elicit stories or examples where it is not. Is it safe enough (conditional on the client machine having not been itself compromised in some way)? Yes.