AJP 足够安全吗？
我们需要在我们的托管服务中托管一个 java richfaces/hibernate 应用程序。根据我们安全部门的要求，我们无法从该应用程序到我们的内部数据库建立任何连接。一种建议的解决方案是创建一个内部 Web 服务，但更改所有数据库层很困难。我想用 AJP 代替。它足够安全吗？
[编辑] 我问这个问题的意思是 apache httpd 将提供 https 服务，并且通过包装 AJP 进入我们的内部服务器可以监控通道（明文）吗？我没有找到协议本身的文档。
We need to host a java richfaces/hibernate app in our hosting service. As a requirement of our security department we cannot make any connection from that application to our internal databases. One suggested solution was to make an internal webservice, but changing all the database layer is hard. I want to use AJP instead. Is it secure enough?
[Edit]
By asking this I mean the apache httpd will be serving https and by wrapping AJP to go inside our internal servers may the channel be monitored (plaintext)? I don't find documentation of the protocol itself.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
AJP 是前端 Web 服务器和后端应用服务器之间 HTTP 的直接替代品。因此，它的安全性并不比 HTTP 更高或更低。如果您选择 AJP，您选择它纯粹是出于性能原因，没有其他原因。如果您出于其他原因考虑它，则需要重新考虑您的要求。
AJP is a direct replacement for HTTP between a front-end web server and a back-end app server. As such, it's no more or less secure than HTTP. If you choose AJP, you choose it purely for performance reasons, nothing else. If you're considering it for other reasons, you need to rethink your requirements.
足够安全有什么用？跨网络明文监控？足够安全，普通 SO 读者无法拦截和读取它？还是美国国家安全局？
安全性是一种权衡，您需要确定您要尝试击退哪种类型的攻击，以及您要付出多少努力。我知道这不能回答您的问题，但我不知道相信不用考虑这个问题就可以回答这个问题。
Secure enough for what ? Plaintext monitoring across the net ? Secure enough that an average SO reader can't intercept and read it ? Or the NSA ?
Security is a trade-off, and you need to determine what sort of attacks you're trying to repel, and how much effort you're going to put in. I know that doesn't answer your question, but I don't believe that question can be answered without thinking about this.