OData 是否适合在政府和金融环境中使用？我需要采取哪些安全预防措施？
乍一看，OData 似乎只适用于“开放”数据库，并且永远不会在需要安全性的环境中使用，尤其是金融或政府客户。
对于当前版本的 OData/WCF，这是正确的观点吗？如果没有，你能分享我需要改变这种观点的任何东西吗？
更新
当前关注的示例包括：
- SQL 注入的可能性增加
- 附加数据验证（使业务逻辑复杂化）
- 未经授权的数据访问
- 数据“原始转储”能力的增强
- 我的意思是，使用 OData 获取 HR 数据比屏幕抓取传统 ASP.net 页面更容易
更新 2
我是否也可以强制执行业务规则？例如，格式正确的 SSN、电话或邮政编码。确保所有字段都已填写怎么样？
At first brush, OData seems like it will only appeal to "open" databases, and would never be used in envrionments where security is needed, especially with financial or government clients.
Is this the correct perspective to have with the current version of OData/WCF? If not, can you share whatever I would need to change that perspective?
Update
Examples of current concerns include:
- Increased possibility of SQL Injection
- Additional Data Validation (complicating business logic)
- Unauthorized Access to data
- Increased ability to do a "raw dump" of data
- by this I mean it is easier to use OData to get to HR data, then it is to screen-scrape a traditional ASP.net page
Update 2
Is it also possible for me to enforce business rules? For example a properly formatted SSN, Phone, or Zip. How about ensuring all fields are filled in?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
oData 只是通过开放 API 公开结构化数据的一种方式。它不要求任何特定形式的安全；可以拥有完全开放的数据集（例如维基数据库）或世界可读但私密可写的数据集（例如国会议员投票的数据库，因此任何人都可以读取它，但只有您可以更新它）。它还支持更复杂的安全结构（例如视频租赁商店允许客户仅查询自己的历史记录）。
关于您的具体问题：
目前（据我所知），ADO.NET 数据服务是唯一可用的 oData 提供程序，并且默认情况下它是安全的。我认为其他人可能会编写默认情况下不安全或允许 SQL 注入的 oData 提供程序，但这是愚蠢的。
另外，请记住，oData 完全脱离了身份验证的概念。您可以自行决定使用对您的 API 有意义的任何身份验证。 WCF 团队最近一系列精彩的博客文章解决了oData 如何与各种形式的身份验证配合使用。
oData is just a way to expose structured data through an open API. It does not requre any particular form of security; it's possible to have fully open datasets (like a wiki database) or world-readable-but-private-writeable (such as a database of votes by members of Congress, so anyone can read it but only you can update it). It also supports more complex security structures (such as a video rental store allowing customers to query only their own history).
Regarding your specific concerns:
IQueryable, which properly escapes all values.Right now (to my knowledge), ADO.NET Data Services is the only oData provider available, and it's secure by default. I suppose that someone else could write an oData provider that wasn't secure by default or allowed SQL injection, but that would be foolish.
Also, remember that oData is completely divorced from the concept of authentication. It's up to you to use whatever authentication makes sense for your API. There's a great recent series of blog posts from the WCF team that address how oData works with various forms of authentication.
您使用 OData 的业务案例是什么？ OData 的存在主要是为了以与平台无关的方式公开您的数据...以便 .NET、Java、Php、Python、REST 等客户端都可以访问您的数据。这是你的用例吗？
或者您是否尝试通过服务层（一种 SOA 方法）公开数据，以便您的客户端（您控制的）更好地与数据源解耦。在这种情况下，OData 可能不是正确的解决方案。我将 OData 作为数据服务层的一部分进行了研究，发现它太慢了。我现在正在研究 Devforce 它实现了对实体框架模型的基于服务的访问（通过其 BOS服务）...完整的 CRUD 操作，包括 LINQ to 服务托管模型。
安全性达到您想要的级别，可以查看 OData 或通过 DevForce。选择正确的数据远程解决方案，然后研究正确的安全实施。
What's your business case for using OData? OData primarily exists to expose your data in a platform agnostic manner... so that .NET, Java, Php, Python, REST, etc clients can all access your data. Is that your use-case?
Or are you trying to expose your data via a service layer (kind of an SOA approach) so that your clients (which you control) are better decoupled from your data sources. In that case, OData may not be the right solution. I looked at OData as part of a data service layer and decided it is too slow. I'm now looking at Devforce which implements service-based access for Entity Framework models (via their BOS service)... full CRUD operations including LINQ to service-hosted model.
Security is to you desired level is possible either view OData or via DevForce. Pick the correct data-remoting solution, then research the correct security implementation.
当然，您可以在政府解决方案中使用它。 OData只是一种访问数据的方式，与确保信息安全无关。您必须在传输级别 (SSL) 而不是在应用程序级别（向应用程序提供登录名和密码）实现安全性。
有很多方法可以解决这个问题。一个例子是，如果您使用 SSL，您可以强制客户端提供客户端证书并让它进行身份验证。一旦该人进行了身份验证，您就可以使用您的应用程序来限制他们可以看到的内容（也许他们只能看到他们的客户信息，因此所有查询都会自动限制该人看到这些信息。）
Sure you can use it in government solution. OData is just a way of accessing data, it has nothing to do with making the information secure. You have to implement the security at the transport level (SSL) and not at the application level (provide login and password to application).
There are many ways to go about this. One example is if you are using SSL, you can force your client to provide a client certificate and have that do the authentication. Once the person has authentication, you can use your application to limit what they can see (maybe they can only see their client information, so all queries automatically limit the person to seeing that.)