我应该为公共站点扩展 ASP.NET 安全性吗？
我有一个 ASP.NET MVC 站点，其中包含一个受 ASP.NET SQL 支持的授权保护的私有站点管理应用程序。我需要添加公共站点的登录名，以允许访问者注册帐户。
我认为我应该为公共站点创建完全独立的存储，而不是扩展现有的用户数据库并依靠角色将公共用户排除在后台之外。有什么理由不这样做呢？
I have a ASP.NET MVC site with a private site administration application secured with ASP.NET sql-backed authorization. I need to add a login for the public site to allow visitors to sign up for an account.
I am thinking I should create totally seperate storage for the public site, rather than extend the existing user db and rely on roles to keep public users out of the back office. Is there any reason not to do this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，有。您可以将私有数据库与公共数据库隔离。创建 2 个数据库用户帐户，确保他们只能访问所需的 1 个数据库。公共和私人应用程序将使用不同的帐户。然后锁定数据库帐户，以确保它们仅拥有 Web 应用程序运行所需的权限。 （我不确定你正在使用什么数据库。如果你使用的是 ms-sql，请确保他们无权访问 xp_cmdshell，如果你使用的是 mysql，请确保该帐户没有 FILE 权限。还有其他注意事项但这超出了本问题的范围。）
如果在您站点的公共部分发现 SQL 注入漏洞，那么他们将能够访问该数据库，而使您的私有站点不受攻击的影响。
Yes there is. You can isolate the private database from the public database. Create 2 database user accounts, make sure they only have access to the 1 database they need. The public and private apps will use different accounts. Then lock down the database accounts to make sure they only have the rights needed for the web app to function. (I'm not sure what database you are using. if you are using ms-sql make sure they don't have access to xp_cmdshell, if you are under mysql make sure the account doesn't have FILE privileges. There are other considerations but this is outside the scope of this question.)
If a SQL Injection vulnerability is found in the public part of your site then they will be able to access that one database leaving your private site unaffected by the attack.
时间和潜在的金钱可能是原因之一。不然的话，如果你有时间的话。根据需要，在不确切了解当前问题的情况下，它也可能会增加很多复杂性......
HTH。
Time and potentially money would be one reason. Otherwise, if you have the time. Depending on the need, not knowing exactly the issues at hand, it could also add a lot of complexity...
HTH.
您是否会拥有一位具有多个角色的用户？您最终会将同一用户存储在多个数据库中吗？如果是这样，我会将您的用户保留在统一的数据库中。
Will you ever have a user with more than one role? Could you end up storing the same user in more than one database? If so, I would keep your users in a unified DB.