rubycas CAS 通过 ssl，站点通过非 SSL
我正在尝试确定我所面临的安全风险有多大 当我让 rubycas 本身通过 https 运行时，但我的实际网站 在http下运行。我面临这个问题的原因是 站点部署在 Heroku 上，这意味着 ssl 要么是真正的 昂贵或真的很痛苦。
除了登录详细信息之外，我还传递用户名册 （授权）到每个站点，然后存储在会话中。
任何意见都将受到高度赞赏。
I'm trying to determine how much of a security risk I'm looking at
when I have rubycas itself running over https, but my actual sites
running under http. the reason I'm faced with this issue is that the
sites are deployed on heroku, which means ssl is either really
expensive or really a pain.
In addition to the login details, i also pass user rolls
(authorization) to each site that is then stored in a session.
Any input is greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这种方法的问题是 sessionid（url 或 cookie）和交换的数据都没有加密。因此，数据可以在从服务器到用户的途中以及从用户到服务器的途中被读取和操作。
即使是只能嗅探流量而无法操纵流量的被动攻击者，也可能造成损害：攻击者只需将 sessionid 复制到他或她自己的浏览器中即可。公共无线连接通常使用透明代理，因此攻击者和受害者都具有相同的公共 IP 地址，这使得应用程序很难区分他们。
有一个名为 Firesheep 的工具可以使这种攻击极其容易 。
The problem with this approach is that neither the sessionid (url or cookie) nor the exchanged data is encrypted. Therefore the data can be read and manipulated both on the way from the server to the user and on the way from the user to the server.
Even a passive attacker that can just sniff the traffic without being able to manipulate it, can create damage: The attacker can just copy the sessionid into his or her own browser. Public wireless connections often use a transparent proxy, so both the attacker and the victim have the same public ip-address, which makes it difficult for the application to tell them apart.
There is a tool called Firesheep that makes this kind of attack extremely easy.