HTTP 403或404用于访问受限的WEB资源？
我的问题与此非常相似 返回“正确”错误代码，还是保护隐私？ ，但我想听到一些不同的答案。
我们有网站，其中大部分页面可能会被未登录的用户访问。但是，当未登录的用户尝试访问需要授权的资源（页面）（用户必须具有 FooRole 角色）时，我们会自动将他重定向到登录页面，并在提供正确的凭据后返回到受限资源。如果用户提供了正确的凭据，但他的访问权限恰好不够（他有 BarRole 但没有 FooRole），那么 WEB 站点应该做什么？
在当前的实现中，我们返回 HTTP 403 响应（禁止）。但一些开发人员认为，必须返回 404 代码，因为它提供了更好的安全性 - 用户不应区分不存在和不可访问的资源。从安全角度来看，返回 404 可能更好，但在所描述的情况下，用户被重定向到登录页面，并且该行为“暗示”此类页面存在，因此返回 404 不太合乎逻辑（它是我的想法）。如果用户已经被授权并尝试访问受限资源（直接修改 URL），那么，逻辑上可能会返回 404 错误。
也许这样的“自动重定向到登录”功能不好？你能建议我在这种情况下什么行为更“标准/良好/用户友好/无黑客”？
谢谢！
My question is rather similar to this Return “correct” error code, or protect privacy?, but I'd like to hear some different answers.
We have WEB site most pages of which may be visited by not logged in user. But when not logged in user tries to access resource (Page) that requires authorization (user must have FooRole role), we automatically redirect him to Login page and after providing correct credentials return back to restricted resources. What WEB site should do if user has provided correct credentials, but his access rights has happen to be not enough (he has BarRole but not FooRole)?
In current implementation we return HTTP 403 response (forbidden). But some developers argue that 404 code must be returned because it provides better security - user should not distinguish not existing and not accessible resources. From the point of security it maybe better to return 404, but in described situation user was redirected to Login page and that behavior "hints" that such page exists so it is not very logically return 404 (it is my thoughts). If user has been already authorized and tries to access restricted resources (directly modifying URL) then, well, it may be logically return 404 error.
Maybe such "auto redirect to Login" feature is not good? Can you suggest me what behavior is more "standard/good/user-friendly/hacks-free" in such situation?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为对于登录失败返回准确的 403 错误代码更合适。
至于您模糊实际存在的文件的问题，“通过模糊实现安全性”（流行语）被认为是一种非常差的安全模型，如果用户无权访问这些 URL，那么了解这些 URL 确实没有任何好处无论如何（如果他们破坏了访问控制，我认为有一种相当简单的方法可以找到文件的 URL）。
如果混淆文件名很重要，但我建议未经身份验证的用户为文件夹中的任何文件（是否存在）返回 403（本质上您拒绝他们访问文件夹中的内容，因此错误代码似乎是合法的）大部头书）。我可能建议通过 CustomErrors 处理程序来执行此操作，该处理程序在决定告诉您多少信息之前区分您是否已登录（这样您仍然可以为经过身份验证的人维护准确的 404 错误）或捕获异常的 HttpModule 404 抛出并为经过身份验证的用户和未经身份验证的用户呈现不同的结果。
I believe it is more suitable to return an accurate 403 error-code for login-failures.
As for your issue of obscuring what files actually exist in general "security through obscurity" (buzzwords) is considered a very poor security model and there really should be no benefit to a user to know those URL's if they don't have access to them anyway (And if they break the access control I presume there's a fairly simple way to find the URL's to the files).
If it is important to obfuscate the file names however I would recommend returning 403 for any file in the folder (Existing or not) for unauthenticated users (Essentially you're denying them access to see what's in the folder, so the error code seems legitimate to me). I'd probably recommend doing this via a CustomErrors handler which distinguishes whether you're logged in or not before deciding how much to tell you (That way you still maintain accurate 404 errors for people who are authenticated) or a HttpModule catching the exception a 404 throws and rendering a different result for authenticated vs unauthenticated users.