使用用于显示“安全”的指南发票
我创建了一个学生管理网站（武术学校）。其中包括给学生开具发票。目前，我的用户可以做到这一点的唯一方法是打印发票并将其交给学生。我想为学生创建一种在线查看发票的方式。
我一直在考虑为学生使用 GUID，并将其用作发票查询字符串的参数。 (http://thesite.com/invoice.php?guid=E3D3D122-5AB6-4405-96EC-7C0579710813)
发票将是只读页面，并且不允许访问其余部分该网站。所以我不担心数据包嗅探（我不相信咖啡店里的一些嗅探流量是一个问题，如果他们只能访问随机的学生发票）。
我担心有人能够猜测或获得一组特定的发票（即竞争对手的所有发票）。
我觉得我要么是疯狂地考虑它，要么这是相对论的标准实践。我只是不确定是哪一个。 SO 是一个很好的健全性检查。
谢谢
I've created a web site for student management (martial arts schools). Which includes invoicing students. Currently the only way my users can do this is by printing the invoices and handing them to the students. I'd like to create a way for the students to go to their invoice online.
I've been considering using GUIDs for the students, and using that as the parameter for the query string to the invoice. (http://thesite.com/invoice.php?guid=E3D3D122-5AB6-4405-96EC-7C0579710813)
The invoice would be a read-only page, and allow no access to the rest of the site. So I'm not to worried about packet sniffing (I don't believe some sniffing traffic in a coffee shop is a concern, if all they have access to is a random student invoice).
I am worried about someone being able to guess, or get to a specific set of invoices (i.e. all the invoices of a competitor).
I feel like I'm either crazy for considering it, or it's a relativity standard practice. I'm just not sure which. And SO is a great sanity check.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这实际上是一个良好、安全的过程；当然，您会失去 URL 的可读性，但如果这不是一个大问题，那么这是一个很好的解决方案。这当然是猜不透的。
作为一项附加的安全措施，您可能需要记录发票访问情况。
That's actually a good, secure process; you lose the readability of the URL, of course, but if that's not much of a concern, that's a good solution. It's certainly not guessable.
As an added security measure, you might want to put in place logging of invoice accesses.
我会更进一步，将发票存储为受密码保护的 pdf 文档。这实现了几件事：
I would take it one step further and store the invoice as a password protected pdf document. This achieves several things: