不安全地暴露安全 Web 应用程序的静态资源有哪些危险？
我们正在创建由 https 保护的典型 Web 应用程序。为了能够缓存静态资源，我想通过http公开图像、javascript文件等。否则它们不会被缓存。从安全角度来看，这是否可取？涉及哪些风险？
编辑：我希望代理和浏览器缓存静态内容。实际上，这里最重要的问题是通过反向代理缓存此内容，因此我不必手动将静态内容分发到http服务器（反向代理）。
We are creating typical web applications secured by https. In order to be able to cache static resources, I would like to expose images, javascript files etc. over http. Otherwise they don’t get cahched. Is this advisable from security point of view? What are the risks involved?
EDIT: I would like to have static content cached by proxies and by browsers. Actually, the most important issue here is having this content cached by reverse proxy, so I don't have to distribute static content manually to http server (reverse proxy).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
通过 http 比 https 更容易窥探数据。因此，在这方面，您应该考虑仅通过 http 传输不包含敏感信息的内容。
另一种思考方式：有人会从窥探我公司徽标的图像中受益吗？可能不会。
但是，假设您（无论出于何种原因）有一张包含客户银行帐户详细信息的图像。你应该通过http传输它吗？可能不会。
编辑：
另外，当你混合 http 和在某些浏览器中进行 https 请求时，您的客户会收到令人讨厌的弹出消息，通知他们某些内容未加密
Its easier to snoop data over http than https. So in that aspect you should consider transmitting over http only the things that do not contain sensitive info.
Another way of thinking it: will someone benefit from snooping this image of the logo of my corporation? probably not.
However lets say you have (for whatever reason) an image with the bank account details of a customer. Should you transmit it over http? probably not.
EDIT:
plus when you mix http & https requests in some browsers your customers will get nasty popup messages informing them that some content is unencrypted
根据以下问题，可以缓存HTTPS内容。
网络浏览器是否会通过 https 缓存内容
According to the following questions, caching of HTTPS content is possible.
Will web browsers cache content over https
使用 https，但 JavaScript 使用 http。这不是一个坏主意吗？
除了保密性之外，https 还可以保护流量的完整性。事实证明，几乎在任何可以断开网络连接的地方，都可以将该缺陷升级为恶意损坏。
从可用性的角度来看，（好的）浏览器会将任何包含 http 组件的 https 页面标记为不安全。
Use https, but http for JavaScript. How would that not be a bad idea??
As well as confidentiality, https protects the integrity of traffic. It turns out that almost anywhere you can eves drop a network connection, you can escalate that flaw into malicious corruption.
From a usability point of view, (good) browsers will flag any https page containing http components as insecure.
如果在页面上混合使用 http 和 https 内容，则该页面本质上是不安全的。假设您的页面是通过 https 交付的，并且有一个将数据 POST 到您的网络服务器的表单。现在，因为您的 JS 是通过 http 发送的，所以中间人可以替换其内容并添加一行来更改表单的操作参数。这样，他就可以将数据发布到他的服务器而不是你的服务器。
为了防止这种可能性，浏览器会弹出混合内容警告。它不利于可用性，但从安全角度来看它们是绝对正确的。
如果您担心安全性，请不要混合使用 http 和 https。如果您关心缓存 - 可以缓存 https 响应。如果你有正确的标头，浏览器就会这样做。我猜中间代理也会做同样的事情。也许您可以列出您正在使用的代理，并且有人可以对其缓存策略发表评论。
If you mix http and https content on a page, the page is inherently unsecure. Say your page has is delivered over https, and has a form that POSTs data to your webserver. Now because your JS is sent over http, a man-in-the-middle could replace its contents and add a line to change the action parameter of your form. This way, he'd be able to post data to his server rather than yours.
To prevent such a possibility, browsers pop-up the mixed content warning. Its bad for usability, but from a security perspective they are absolutely right.
If you are concerned about security, don't mix http and https. If caching is your concern - its possible to cache https responses. Browsers do it if you have the right headers. I am guessing intermediate proxies would also do the same. Perhaps you can list the proxies you are using and someone can comment on its caching strategy.