不安全的直接对象引用和搜索引擎
根据OWASP Top 10 List，防止不安全的直接对象引用的一种方法是提供仅间接引用。这些是映射到服务器上的直接（例如数据库）引用的人工引用。映射存储在会话中。
不幸的是，这个解决方案对搜索引擎不太友好。爬虫存储的链接在另一个会话中将无效。
有办法解决这个问题吗？除了映射引用或检查对象访问之外，还有其他解决方案吗？
According to OWASP Top 10 List one way to prevent insecure direct object references is to provide only indirect references. These are artificial references that are mapped to the direct (e.g. DB) references on the server. The mapping is stored in the session.
Unfortunately, this solution is not very search engine friendly. The links stored by the crawler would be invalid in another session.
Is there a way around this problem? Are there other solutions apart from mapping references or checking object access?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您正在描述一个不存在的问题:-)
搜索引擎必须能够抓取和看到的所有内容都必须是公开的，因为搜索引擎可以看到的所有内容都可以被每个人看到。对于根据定义预计公开的数据，对象引用永远不会不安全。不安全意味着它应该受到保护。
因此，如果您对此有疑问，请退一步并仔细查看您的数据。如果它必须是可爬行的，你为什么要试图保护它？如果它应该受到保护，为什么要把它提供给搜索引擎呢？
You are describing a problem that doesn't exist :-)
Everything that a search engine must be able to crawl and see has to be public, because everything a search engine can see, can be seen by everybody. For data that is expected to be public -by definition- the object reference can never be insecure. Insecure means that it is supposed to be protected.
So if you are questioning this, take a step back and look closely at your data. If it must be crawlable, why are you trying to protect it? If it should be protected, why are you supplying it to search engines.