后期操作需要 Rails 授权吗？
我有一个应用程序正在用 Rails 3 编写，带有 Cancan 和 devise。我很好奇从安全角度来看，在控制器上授权后操作是否必要或有帮助？假设我的所有控制器操作都需要通过设备进行身份验证（即用户必须登录）。
我明白为什么我需要通过 cancan 对使用 GET 的控制器操作进行授权，因为用户可以简单地输入他们希望自由访问的 url，并且必须将其锁定。然而，对于帖子，用户必须从表单发布数据，该表单通过令牌来防止 xss 攻击。
在这种情况下，是否可以安全地假设，如果我使用 cancan 限制视图中按钮的可见性，用户将无法恶意提交表单？
非常感谢
编辑：
感谢大家的快速回答。正如下面所指出的，恶意用户可以使用 firebug 等工具伪造表单帖子，因此需要授权。
使用水豚/黄瓜模拟这种类型的交互（用户使用他们破解的表单发布到 URL）的最佳方法是什么？
再次感谢。
I have an app I'm writing in rails 3 w/ cancan and devise. I'm curious if authorizing post actions on your controllers is necessary or helpful from a security standpoint? Assuming all my controller actions require authentication w/ devise (ie user must be logged in).
I can see why I need authorization through cancan on my controller actions that use GET's since a user can simply input the url they wish to visit freely and this must be locked down. However, with posts the user must post the data from a form, which is protected against an xss attack with a token.
In this case would it be safe to assume that if i limit the visibility of, say, a button in my view with cancan that the user wouldn't be able to submit a form maliciously?
Thanks alot
EDIT:
Thanks for the quick answer guys. As it has been pointed out below a malicious user can forge a form post using tools such as firebug and thus authorization is necessary.
What would be the best way to simulate this type of interaction (a user posting to an url with a form they've hacked) using capybara / cucumber?
Thanks again.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
用户可以提交 POST 请求，无论他们是否在您的网站上。您认为安全令牌将有助于防止 XSS 是正确的，但我会为其他攻击方法添加身份验证。
如果您担心安全性，可以阅读一本不错的（免费）电子书：Ruby on Rails 安全指南。它概述了所有常见的恶意攻击形式，甚至探讨了一些较少使用（但同样有效）的方法。它还提供了有关如何使您的应用程序更加安全的出色解决方案。
A user can submit a POST request regardless of whether they are on your website or not. You're correct in thinking that the security token will help prevent XSS, but I would add authentication in for other methods of attacks.
A good (free) ebook to read if you're concerned about security is the Ruby on Rails Security Guide. It outlines all common forms of malicious attacks and even explores some of the lesser used (but just as effective) methods. It also gives great solutions on how to make your application more secure.
您应该在控制器中验证用户授权。
使用 FireBug 等简单工具，您可以手动编辑表单内容，甚至添加更多文本字段或类似字段。 XSS 保护对此无济于事。
You should validate a users authorization in the controller.
With simple tools like FireBug, you can edit the content of a form manually and even add more text fields or similar. The XSS protection won't help you with that.
用户仍然能够在客户端生成按钮（从使用 Firebug 到更改浏览器代码的任何方法都可以）并发送表单。如果我没记错的话，令牌是在 HTML header co 中发送的，那么伪造表单就不成问题了。
The user would still be able to generate the button (any method from using Firebug to changing browser code would do) on client side and send the form. If I remember correctly tokens are sent in HTML header co it wouldn't be a problem to forge the form.