电子商务：可以通过查询字符串传递订单 ID 吗？
我们正在开发一个旨在处理在线支付的网站。 我们想知道，在付款过程中通过查询字符串传递订单/交易 ID 是否可以？ 由于服务器开销，我们不想将此 Id 存储在会话变量中，因此我们认为将其存储在查询字符串中比较合适。
对此有什么想法吗？ 特别是从安全角度来看。
非常感谢。
We're deving a website that's designed to handle online payments. We were wondering, is it OK to pass an Order / Transaction Id through the querystring whilst in the process of making a payment? We'd rather not store this Id in a session variable because of server overhead, so we were thinking storing it in the querystring would be suitable.
Any thoughts on this? Particularly from a security point of view.
Many thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
尝试使您的服务无状态是一个值得追求的目标。 不过，查询字符串中包含订单 ID 是否“安全”取决于很多因素。 您可能需要担心的主要事情是：
我说“可能”是因为您实际上需要担心哪些事情取决于细节您的系统的。 这些事情的发生会带来什么后果？ 根据您的系统的详细信息，这些可能是无害的，也可能是非常严重的。
最容易解决的问题是“泄漏”问题。 使用 HTTPS。 这不仅可以防止“窃听者”，还可以防止由于代理日志和 Referer header 造成的泄漏。
预测问题可以通过对查询字符串中出现的订单 ID 进行加密（是的，除了 HTTPS 之外，我们也不希望最终用户对其进行解密）来解决。 这样，某人就不能仅通过增加/减少查询字符串来查找另一个订单 ID。 （这也可以防止用户轻松计算出系统中的订单总数，这可能是可取的。）
您可以通过在首次分配订单 ID 时记录订单 ID 属于谁来解决用户更改其订单 ID 的问题，或者通过包含 (user, orderid) 对的安全签名作为查询参数。 然后用户只能将自己的订单 ID 更改为自己已经拥有的订单 ID，这至少可以防止他们篡改别人的订单。 如果这样做，您可能不需要对订单 ID 进行加密，除非您想阻止用户知道存在多少订单。
这些只是一些想法。 其中哪些适用于您的系统取决于我之前提到的因素。
Trying to make your service stateless is a worthy goal. Whether having order IDs in query strings is "safe" depends on a lot of things, though. The main things you may need to worry about are:
I say "may" because which things you actually need to worry about depend on details of your system. What are the consequences of these things happening? Depending on the details of your system these may be harmless or they may be very serious.
The easiest problem to solve is the "leaking" issue. Use HTTPS. This not only prevents "eavesdroppers", but also prevents leaks due to proxy logs and Referer headers.
The prediction issue can be solved by encrypting (yes, in addition to HTTPS -- we don't want the end-user decrypting this either) the order ID that appears in the query string. That way someone can't just inc/decrement the query string to find another order ID. (This also prevents users from easily figuring out the total number of orders in your system, which may be desirable.)
You can solve the issue of the user altering their order ID by either recording who an order ID belongs to when it is first allocated, or by including a secure signature of the (user, orderid) pair as a query parameter. Then a user can only change their order ID to one they already own, which at least prevents them from screwing around with someone else's orders. If you do this, you probably don't need to do the encryption of order IDs, unless you want to prevent users from knowing how many orders exist.
These are just some ideas. Which of these apply to your system depend on the factors I mentioned earlier.
在查询字符串中传递敏感信息（例如订单号）通常是一个坏主意，原因如下：
1) GET url 以明文形式传递，这意味着客户端和服务器之间的任何内容都可以读取并捕获订单号的请求。 如果您的服务器依赖订单号来执行任何重要操作，那么这就是公开的滥用邀请。
2) 大多数代理和访问日志将记录包括 GET 查询在内的网址，这意味着客户的订单号将存储在任意数量的计算机（包括您的服务器）上的访问日志中。 您很可能无法控制这种行为，这是非常糟糕的（TM）。
为了确保您的应用程序安全，您应该将实际订单号存储在服务器上的会话中，并通过 cookie（最好是加密的）将其传递给用户。 以明文形式传递任何重要的内容很容易被滥用，因此不应尝试传递任何重要的内容。
Passing sensitive infomation (e.g. order numbers) in a query string is generally a bad idea for a number of reasons:
1) The GET url is passed as plaintext, which means anything between the client and the server can read and capture the order number from the request. If your server relies on the order number to do anything important, then it's a wide open invitation for abuse.
2) Most proxies and access logs will log web addresses including the GET query, meaning that the customer's order number will be stored in access logs on any number of machines (including your server). You are most likely unable to control this behavior, which is VERY BAD(TM).
To make your app secure, you should store the actual order number in a session on the server, and pass it to the user in a cookie (preferably encrypted). Passing anything important in plaintext is prone to abuse and should not be attempted for anything important.
加密订单 ID 就可以了 - 您还可以考虑对原始订单 ID 进行哈希处理，并将其和哈希令牌传递到查询字符串中。 我不认为这是一个安全风险，因为我不会将订单 ID 视为敏感数据。 您需要做的就是确保用户没有以任何方式操纵它。
http://www.duncangunn.me.uk/dasblog/ 2009/08/01/VerifyingTheIntegrityOfQueryStringParameters.aspx
Encrypting the Order ID would be fine - you might also consider hashing the original Order ID, and passing it and the hashed token in the querystring. I don't see this as a security risk as I wouldn't consider the Order ID as sensitive data. All you need to do is ensure that the user hasn't manipulated it in any way.
http://www.duncangunn.me.uk/dasblog/2009/08/01/VerifyingTheIntegrityOfQueryStringParameters.aspx
您应该捕获数据库中的订单。 不建议将其传递到查询字符串中。
you should be capturing the order in your db. It is not advisable to pass it in a query string.