将变量值从一个页面安全地传递到另一页面
将变量从一个页面传递到另一个页面时
为了避免用户弄乱 URL 参数值
最好...
1) 通过会话传递变量
2) 在 URL 中传递变量以及签名
When passing variable from one page to another
To avoid the user messing around with the URL parameter Values
Is it best to ...
1) pass the variable via session
2) pass the variable in the URL along with a signature
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
只要您传递签名，将值传递到哪里并不重要，因为您将始终检查签名完整性
。我要做的就是传递会话中的所有内容（包括签名）。只是为了保持 URL 干净。但这取决于您和您的特定用例。
As long as you're passing in a signature, it wouldn't matter where are you passing the values because you will always check for the signature integrity
What I would do is pass everything (including the signature) in the session. Just to keep the URL clean. But that's up to you and your particular use case.
如果您使用会话，用户无法控制值的内容。
此外，如果您有 视图状态加密启用，您可以使用视图状态。视图状态的优点是它被本地化到单个页面。这意味着当用户打开您网站的两个选项卡时，变量将本地化到特定选项卡。
请参阅http://www.codeproject.com/KB/viewstate/AccessViewState.aspx 了解如何从另一个页面访问视图状态。
If you use the session, the user cannot control the contents of the values.
Also, if you have view state encryption enabled, you could use the view state. The advantage of the view state is that it's localized to a single page. This means that when the user has two tabs open of your website, the variables are localized to the specific tabs.
See http://www.codeproject.com/KB/viewstate/AccessViewState.aspx for how to access view state from another page.
取决于您的用例。在大多数情况下，会话更安全。如果有人可以破坏您的服务器来获取您的会话数据，那么您需要担心的事情就不同了。但如果您将会话数据存储在其他人可以看到的地方，那就不好了;-)。
URL 签名理论上可以被暴力破解。由于参数可能很短并且有时是可预测的，因此可能会给了解加密的人带来一些攻击点。但这并不是一件小事。但如果安全性是您的首要选择，那么我不会允许这些数据离开您的服务器。
Depends on your use case. Session IS in most cases safer. If someone can compromise your server to get your session data, then you have different things to worry about. It would be bad though if you store session data in a place where other people can see it ;-).
URL signature could theoretically be brute-forced. Since the parameters are probably short and they may be sometimes predictable it may give someone who knows about encryption some point of attack. This is not trivial though. But if security is top option for you then I'd not allow this data to leave your server.
如果您真的担心用户会疯狂并剥离参数，那么您可以使用会话状态，但是您可能会丢失历史记录，即后退按钮。
第二个选项看起来不错，但如果用户正在删除一些东西，您就无法确定该参数是否存在。
所以两者的混合看起来不错。
If you are really worried user going crazy and stripping down params, then you can go with Session states, however you may lose history, i.e Back Forward buttons.
The second option looks good but if user is stripping things you can't be sure that the param even existed.
So a mix of both looks good.