SSL：如何平衡API性能与安全性？
安全性很差的 API 很常见。例证 - 此报道。
这就引出了一个问题，当涉及到 SSL 时，如何平衡安全性和性能？显然，用户名和密码等敏感信息应通过 SSL 发送。如果后续调用可能使用 API 密钥呢？当涉及需要身份证明的 API 调用时，什么时候可以使用未加密的连接？
APIs with terrible security are common place. Case in point - this story on TechCrunch.
It begs the question, how do you balance security with performance when it comes to SSL? Obviously, sensitive information such as usernames and password should be sent over SSL. What about subsequent calls that perhaps use an API key? At what point is it okay to use an unencrypted connection when it comes to API calls that require proof of identity?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果允许混合内容，那么中间人可以重写混合内容以注入 JS 来窃取页面中已有的敏感信息。
由于咖啡馆等提供免费无线访问，中间人攻击并不是那么困难。
https://www.eff.org/pages/how-deploy-https- Correctly 给出了很好的解释：
If you allow mixed content, then a man-in-the-middle, can rewrite mixed content to inject JS to steal sensitive information already in the page.
With cafés and the like providing free wireless access, man-in-the-middle attacks are not all that difficult.
https://www.eff.org/pages/how-deploy-https-correctly gives a good explanation:
问题在于，在不了解应用程序性能的情况下，尝试在没有指标的情况下优化应用程序是错误的。这就是导致开发人员决定让 API 不加密的原因，只是认为它可以再争取 10 毫秒的性能。简而言之，平衡安全问题与性能的最佳方法是首先考虑安全问题，从真实客户那里获取一些负载（而不是某些架构师痴迷的白板简笔画），并在您怀疑性能可能是一个问题时从代码中获取真实指标。问题。我有一种奇怪的感觉，这与安全无关。
The problem is that without understanding the performance of your application it is just wrong to try and optimize the application without metrics. This is what leads to decisions by devs to leave an API unecrypted simply thinking it's eeking out another 10ms's of performance. Simply put the best way to balance security concerns versus performance is to worry about security first, get some load from real customers(not whiteboard stick figures being obsessed over by some architect) and get real metrics from your code when you suspect performance might be an issue. I have a weird feeling that it won't be security related.
在采取行动之前，您需要收集一些有关 SSL 所谓性能问题的证据。你可能会得到很大的惊喜。
You need to gather some evidence about the alleged performance issues of SSL before you leap. You might get quite a surprise.