仅允许某些客户端进行 AJAX 请求
我有一个 AJAX 密集型 Web 应用程序，其中的请求不安全，这意味着没有客户端标识。我不检查是否是我的应用程序在服务器上发出请求。
最近我发现有人使用我的 ajax 请求 URL 创建了一个模仿我的 Web 应用程序的 iPhone 应用程序。我添加了一个过滤器，通过查看用户代理字符串来丢弃来自 iPhone 的请求。这绝对是一个临时解决方案。
我如何确保请求源自我的应用程序，而不是阻止某些用户代理？如果我添加更多服务，例如 FB 应用程序、Google Gadget 等，我希望这些服务也能发出请求。
问题是我如何确保请求源自我的应用程序并丢弃其他所有内容。
I have an AJAX intensive web application where the requests are unsecured, meaning there is no client identification. I don't check whether its my application that's making the request on the server.
Recently i found out that some one has used my ajax request urls to create an iPhone app that mimics my web app. I added in a filter to discard requests from iPhone by looking in the user agent string. This is definitely a temporary solution.
Instead of blocking certain user agents, how can i make sure that the request originated from my application? If i add more services like an FB app, Google Gadget etc i want these to make requests as well.
The question is how can i make sure that the request originates from my app(s) and discard everything else.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您永远无法确定这是否是您的应用程序，因为您的应用程序发送到服务器的所有内容也可以由任何其他应用程序发送。但是，您可以让您的服务变得更难以通过您的应用程序使用。您可以将一些密钥作为参数或 URL 的一部分发送，这些密钥会经常更改，并且必须包含在您自己的脚本中。这将使其他应用程序的查找和使用变得非常简单，但如果这是每小时都在变化的东西，那么至少不可能编写一个始终有效的简单 AJAX 请求，而不获取脚本、解析它并找到密钥，在这种情况下，至少没有人会假装相信您的服务对所有人公开可用。这几乎是你能做的一切，让它变得更加困难和烦人。你永远无法让它变得不可能，但足够困难可能就足够了。
You can never be sure if it is your application or not, simply because everything that your application sends to the server can also be sent by any other application. But you can make your service more difficult to use by not your applications. You can have some key sent as a parameter or part of URL that would change frequently, and would have to be included in your own scripts. It would make it quite trivial to find and to use by some other application but if that was something that changes every hour then at least it would be impossible to write a simple AJAX request that would always work, without getting your script, parsing it and finding the key, in which case no one would at least pretend to believe that your service is publicly available to everyone. This is pretty much all you can do, make it more difficult and annoying to use. You will never be able to make it impossible, but sufficiently difficult may be good enough.
哎呀，我会在这里走一条完全不同的路线。
告诉 iPhone 应用程序的创建者，您很乐意让他们继续付费使用您的服务。选择每次安装 0.50 美元左右的价格。这样他们就可以在商店中以 0.99 美元的价格出售该应用程序；让苹果公司获得 30% 的折扣，你也能从这笔交易中得到一点好处。
如果有人不厌其烦地构建了该应用程序，您也可以利用它！
Heck, I'd go a completely different route here.
Tell the creator of the iPhone app that you'll be happy to let them continue using your services for a fee. Pick something like $.50 or so per install. That way they could sell the app in the store for $0.99; let Apple have their 30% cut and you get a bit on the deal as well.
If someone has gone to the trouble of building the app you may as well capitalize on it!
您可以使用随响应一起发送的特殊令牌，您将在 AJAX 调用中查找该令牌。这将确保调用者必须首先加载您的网页。然而，这仍然不能保证用户不是来自 iPhone 应用程序。该应用程序可以简单地处理相同的信息并充当代理，并且无法根据 HTTP 请求来判断这一点。
您的网站是否定义了任何使用条款？如果确实如此，您应该做的第一件事是联系Apple并告诉他们该应用程序违反了您的使用条款，并且您希望下架该应用程序。如果没有，您应该写一些使用条款，并联系应用程序的作者，通知他们更改，并要求他们下架该应用程序，或达成一些其他条款。如果这一切都失败了，最好的办法就是让直接使用 AJAX 调用变得更加困难。诸如混淆和最小化 JS（以及将服务器端函数重命名为不那么好命名）之类的简单事情将提高抓取数据的门槛。
You can use a special token that you send down with your response, that you would look for in the AJAX call. That would ensure that the caller had to first load your web page. However, that still can't guarantee that the user isn't coming from the iPhone app. The app could simply process the same information and act as a proxy, and there's no way to tell that based on HTTP Requests.
Does your site have any terms of use defined? If it does, the first thing you should do is contact Apple and tell them that the app is in violation of your terms of use, and you want the app pulled. If it doesn't, you should write up some terms of use, and contact the app's author notifying them of the change, and requesting they take the app down, or come to some other terms. If all that fails, your best bet is to just make it more difficult to use the AJAX calls directly. Simple things like obfuscating and minimizing the JS (and renaming your serverside functions to not be so well named) will raise the bar on scraping your data.
这将很困难，因为在某些时候您的服务器和应用程序需要共享秘密。该秘密将随应用程序一起分发，并可供逆向工程师使用。现在，您可以向每个表单添加 CRSF 令牌（请参阅此 wiki）。分发应用程序然后将其明确识别为您的应用程序是一个尚未解决的问题。
This will be hard since at some point your server and app need to share a secret. That secret will be distributed with the app and will be available to reverse engineers. For now you can add a CRSF token (see this wiki) to each form. Distributing an app and then identifying it as positively yours is an unsolved problem AFAIK.
我不知道请求的性质，但如果用户需要进行身份验证，那么您每次都需要在服务器上执行此操作。正如 Zed 指出的那样，这不会阻止其他开发人员调用您的 API。我同意你可以让它变得更加困难，所以这基本上是一场军备竞赛，具体取决于阻止这个第三方应用程序运行的重要性。
I don't know the nature of the request but if the user needs to be authenticated then you'll need to do that on the server every time. This won't prevent another developer from calling your API though as Zed points out. I agree that you can make it more difficult so it's basically an arms race depending on how important it is to prevent this third-party app from working.