Asp MVC 2：混淆实体 ID
项目类型：Asp MVC 2/NHibernate/C#
问题
如果您在 Web 应用程序中有一个编辑页面，您将遇到这样的问题：您必须发送并接收您正在编辑的实体的 ID、子实体的 ID实体，可以通过下拉菜单选择的实体，...
因为它可能修改表单帖子，邪恶的用户可能会尝试发回另一个ID，这可能会授予他更多权利（如果该ID与安全实体相关） ）。
我的方法
- 创建一个 GUID 并将其与 ID 关联
- 将关联保存在 http 会话中
- 等待响应并从接收到的 GUID 中提取真实 ID。
问题：
您使用什么技术来混淆实体 ID？
Project type: Asp MVC 2/NHibernate/C#
Problem
If you have an edit page in an web application you will come to the problem that you have to send and then receive the id of the entity you're editing, the IDs of sub-entities, entities that can be selected by dropdownmenus,...
As it is possible to modify a form-post, an evil user could try to send back another ID which maybe would grant him more rights (if i.e. that ID was related to a security entity).
My approach
- Create a GUID and associate it with the ID
- Save the association in the http session
- Wait for the response and extract the real ID out of the received GUID.
Question:
What techniques do you use to obfusicate an entity-ID?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您对 GUID 做了这么多，为什么不只使用 GUID 作为实际存储在数据库中的实体本身的标识（尽管 我建议不要这样做）？
或者你可以有一个服务器端加密方案，对id进行加密，然后解密（这与你正在做的事情很长，只是你没有在会话中存储任何像这样随机的东西（恶心:)）。
您甚至可能根本忘记尝试执行此操作，因为许多网站都受到此问题的“影响”，而且这显然不是问题（例如 StackOverflow）。开销太大了。
另外，如果您担心安全性，为什么不在单个操作/甚至实体级别上设置某种细粒度的权限。这也可以解决一些问题。
编辑：
您的解决方案的另一个问题是唯一标识符不一致。如果用户说“ID as23423he423fsda 有‘无效’数据”，如果每个请求都发生变化，您如何知道它属于哪个 ID（假设您也将更改 URL 中的 id）？使用始终哈希为相同值的加密算法会更好，因此，您可以轻松执行查找（如果需要）并且用户具有一致的标识符。
If you're doing that much for GUIDs, why not just use GUIDs for the identity of the entity itself that's actually stored in the database (though I'd advise against it)?
Or you could have a server side encryption scheme that encrypts and then subsequently decrypts the id (this is a long the same lines as what you're doing except you're not storing anything random like this in the session (yuck :) ).
You could even forget trying to do this at all since a lot of sites are "affected" by this issue, and it's obviously not a problem (StackOverflow for example). The overhead is just too much.
Also, if you're worried about security, why don't you have some sort of granular permissions set on the individual action/even entity level. This would solve some problems as well.
EDIT:
Another problem with your solution is inconsistent unique identifiers. If a user says "ID as23423he423fsda has 'invalid' data", how do you know which ID it belongs to if it's changing on every request (assuming you're going to change the id in the URL as well)? You'd be much better of with an encryption algorithm that always hashes to the same value therefore, you can easily perform a lookup (if you need it) and also the user has consistent identifiers.
您的控制器应该不受修改的 POST 数据的影响。在显示或修改属于用户的记录之前，您应该始终检查相关记录是否属于经过身份验证的用户。
Your controllers should be immune to modified POST data. Before displaying or modifying records belonging to a user, you should always check whether the records in question belong to the authenticated user.