确保 JSONP 安全？
我有一个使用 JSONP 进行跨域 ajax 调用的脚本。这很好用，但我的问题是，有没有办法阻止其他网站访问这些 URL 并从中获取数据？我基本上想制作一个允许的网站列表，并且仅在列表中返回数据。我正在使用 PHP，并且认为我也许可以使用“HTTP_REFERER”，但已了解到某些浏览器不会发送此信息....？？？有什么想法吗？
谢谢！
I have a script that uses JSONP to make cross domain ajax calls. This works great but my question is, is there a way to prevent other sites from accessing and getting data from these URL's? I basically would like to make a list of sites that are allowed and only return data if they are in the list. I am using PHP and figure I might be able to use "HTTP_REFERER" but have read that some browsers will not send this info.... ??? Any ideas?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
确实没有有效的解决办法。如果您的 JSON 可通过浏览器访问，那么其他站点同样可以访问它。对于 Web 服务器来说，除了标头之外，来自浏览器或其他服务器的请求实际上无法区分。就像 ILMV 评论的那样，引用者（和其他标头）可以被伪造。毕竟，他们是自我报告的。
安全从来都不是完美的。一个足够坚定的人可以克服任何现有的安全措施，但安全的目标是创造足够高的威慑力，阻止外行和/或大多数人投入必要的时间和资源来损害安全。
考虑到这一点，您可以创建足够高的进入壁垒，以便其他网站可能不会在设置进入壁垒后提出请求。您可以生成获取 json 数据所需的一次性令牌。一旦使用 token 获取 json 数据，该 token 随后就会失效。为了检索令牌，必须使用嵌入在 javascript 页面中的令牌来请求网页，然后将该令牌放入 json 数据的 ajax 调用中。将此与过期令牌以及 JavaScript 中的足够混淆相结合，您就创建了足够高的障碍。
请记住，这并非不可能规避。另一个网站可以从 javascript 中提取令牌，或者拦截 ajax 调用并在多个点劫持数据。
There really is no effective solution. If your JSON is accessible through the browser, then it is equally accessible to other sites. To the web server a request originating from a browser or another server are virtually indistinguishable aside from the headers. Like ILMV commented, referrers (and other headers) can be falsified. They are after all, self-reported.
Security is never perfect. A sufficiently determined person can overcome any security measures in place, but the goal of security is to create a high enough deterrent that laypeople and or most people would be dissuaded from putting the time and resources necessary to compromise the security.
With that thought in mind, you can create a barrier of entry high enough that other sites would probably not bother making requests with the barriers of entry put into place. You can generate single use tokens that are required to grab the json data. Once a token is used to grab the json data, the token is then subsequently invalidated. In order to retrieve a token, the web page must be requested with a token embedded within the page in javascript that is then put into the ajax call for the json data. Combine this with time-expiring tokens, and sufficient obfuscation in the javascript and you've created a high enough barrier.
Just remember, this isn't impossible to circumvent. Another website could extract the token out of the javascript, and or intercept the ajax call and hijack the data at multiple points.
您是否有权访问您想要授予 JSONP 访问权限的服务器/站点？
您可以做的（尽管并不理想）是在允许查看 JSONP 的页面加载上将记录添加到 IP 的数据库中，然后在 jsonp 加载上检查该记录是否存在。如果合适的话，也许可以在记录上注明有效期。
例如
http://mysite.com/some_page/ - 用户加载页面，将其 IP 添加到允许的数据库中用户
http://anothersite.com/anotherpage - 如上所述，添加到数据库
如果爬虫（或其他站点）设法找出您使用什么方法来允许用户查看记录，那么这可以很容易地解决。 JSONP，他们只需要先点击页面即可。
Do you have access to the servers/sites that you would like to give access to the JSONP?
What you could do, although not ideal is to add a record to a db of the IP on the page load that is allowed to view the JSONP, then on the jsonp load, check if that record exists. Perhaps have an expiry on the record if appropriate.
e.g.
http://mysite.com/some_page/ - user loads page, add their IP to the database of allowed users
http://anothersite.com/anotherpage - as above, add to database
Although this could quite easily be worked around if the scraper (or other sites) managed to work out what method you are using to allow users to view the JSONP, they'd only have to hit the page first.
使用一个 cookie 来保存每个 jsonp 请求所使用的令牌怎么样？
根据设置，如果您不想使用 cookie，也可以使用变量。
How about using a cookie that holds a token used with every jsonp request?
Depending on the setup you can also use a variable if you don't want to use cookies.
使用 Web Worker 中的 importScript 与 jsonp 非常相似。
像 AlexPoon 所说的那样进行双重检查。主脚本到 Web Worker，Web Worker 进行服务并返回安全查询。如果网络工作人员在没有询问的情况下回答主脚本或者使用错误的令牌，那么最好将您的网站转发到涅槃。如果向服务器询问错误的令牌，请不要回答。 Cookie 不会与 importScript 请求一起发送，因为文档在 Web Worker 级别不可用。始终通过发布请求发送与安全相关的 cookie。
但仍然存在很多风险。中间的那个人知道怎么做。
Working with importScript form the Web Worker is quite the same as jsonp.
Make a double check like theAlexPoon said. Main-script to web worker, web worker to sever and back with security query. If the web worker answer to the main script without to be asked or with the wrong token, its better to forward your website to the nirvana. If the server is asked with the wrong token don't answer. Cookies will not be send with an importScript request, because document is not available at web worker level. Always send security relevant cookies with a post request.
But there are still a lot of risks. The man in the middle knows how.
我确信你可以使用 htaccess 来做到这一点 -
确保你的标头发送“HTTP_REFERER” - 我不知道有哪个浏览器不会在你告诉它的情况下发送它。 （如果您仍然担心，请优雅地回退）
然后使用 htaccess 允许/拒绝来自正确引用者的访问。
I'm certain you can do this with htaccess -
Ensure your headers are sending "HTTP_REFERER" - I don't know any browser that wont send it if you tell it to. (if you're still worried, fall back gracefully)
Then use htaccess to allow/deny access from the right referer.