这两个有什么区别......？
从安全角度来看，有哪些要点可以帮助使用 .master 文件与 .aspx 文件获得更好的结果？
From a security stand point what are a couple major points that would aid in the result of using a .master file versus a .aspx file?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
从安全角度来看，.master 文件和 .aspx 文件实际上没有区别。当涉及到页面生命周期时，它们确实具有独特的执行路径，但它们以相同的方式执行，并且容易出现相同的安全缺陷和问题。保护。
也就是说，.master 文件允许的代码减少（以及迫使您考虑泛化）将在帮助您开发可靠（与安全相关）的网站方面大有帮助。
From a security standpoint, there isn't really a difference in a .master file and a .aspx file. They do have a unique execution path when it comes to a page life cycle, but they are executed in the same way and would be prone to the same security flaws & protections.
That said, the reduction of code that a .master file allows (as well as forcing you to think about generaliation) will go a long way in helping you develope a reliable (related to security) website.
从技术上讲，从安全角度来看没有重大区别。您可以从母版页内实现安全逻辑，这将确保它包含在使用该母版页的每个页面上。您可能会说这使事情变得更加安全，因为人为错误的可能性较小:)。
Technically, there's no major difference from a security standpoint. You could implement your security logic from within the Master page, which would insure that it's included on every page that uses that MasterPage. You could argue this makes things more secure because there is less chance for human error :).
主页面和内容页面构成浏览器中的 1 个呈现页面。母版页的作用是在整个网站或部分网站中创建共同的外观和感觉。如果需要，您甚至可以嵌套母版页。
ASP.NET 作为一个整体已经默认内置了相当多的安全挂钩。 RequestValidation 可以防止恶意输入，参数化查询可以防止 SQL 注入，成员身份验证，角色授权，UrlAuthorization 可以防止人们猜测 url，并且可能能够看到敏感数据，...
请务必查看 模式和样式实践安全指南索引。
Both master and content page make up 1 rendered page in your browser. The master page is there to create a common look and feel throughout your entire site, or parts of it. You can even nest master pages if needed.
ASP.NET as a whole already has quite some security hooks built in by default. RequestValidation to prevent malicious input, parametrized queries are possible to prevent SQL injection, Membership for authentication, Roles for authorization, UrlAuthorization to prevent people of guessing urls and might be able to see sensitive data, ...
Be sure to also check out patterns & practices Security How Tos Index.
这是一个棘手的家庭作业问题——两者都不应该与安全有任何关系。
Its a trick homework question -- neither should have anything to do with security.