POST 数据加密 - HTTPS 足够吗？
考虑一个场景，其中用户身份验证（用户名和密码）由用户在页面的表单元素中输入，然后提交。 POST 数据通过 HTTPS 发送到新页面（其中 php 代码将检查凭据）。现在，如果黑客位于网络中，并说可以访问所有流量，那么在这种情况下应用程序层安全性 (HTTPS) 是否足够？我的意思是，是否有足够的 URL 加密或者是否需要传输层安全？
Consider a scenario, where user authentication (username and password) is entered by the user in the page's form element, which is then submitted. The POST data is sent via HTTPS to a new page (where the php code will check for the credentials). Now if a hacker sits in the network, and say has access to all the traffic, is the Application layer security (HTTPS) enough in this case ? I mean, would there be adequate URL encryption or is there a need to have Transport Layer security ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
是的，所有内容（包括 URL）都通过加密通道进行。坏人唯一能发现的是您正在连接的服务器的 IP 地址，以及您正在使用 HTTPS。
好吧，如果他也监视您的 DNS 请求，他可能也知道 IP 地址的域名。但仅此而已，路径、查询参数和其他所有内容都是加密的。
Yes, everything (including the URL) is going through the encrypted channel. The only thing that the villain would find out is the IP address of the server you are connecting to, and that you are using HTTPS.
Well, if he was monitoring your DNS requests as well, he might also know the domain name of the IP address. But just that, the path, query parameters, and everything else is encrypted.
是的。在 HTTPS 中，只有握手是未加密的，但甚至 HTTP GET/POST 查询也是加密的。
然而，不可能隐藏您正在连接的服务器，因为他可以看到您的数据包，他可以看到您的数据包所在的 IP 地址。如果您也想隐藏这一点，您可以使用代理（尽管黑客会知道您正在发送到代理，但不知道您的数据包随后会去往何处）。
Yes. In an HTTPS only the handshake is done unencrypted, but even the HTTP GET/POST query's are done encrypted.
It is however impossible to hide to what server you are connecting, since he can see your packets he can see the IP address to where your packets go. If you want to hide this too you can use a proxy (though the hacker would know that you are sending to a proxy, but not where your packets go afterwards).
“如果”客户端是安全的，HTTPS 就足够了。否则，有人可以安装自定义证书并扮演中间人的角色。
作为 Web 开发人员，除了禁止 HTTP 请求之外，无能为力。这可以通过 Apache 中的 mod_rewrite 来完成。
HTTPS is sufficient "if" the client is secure. Otherwise someone can install a custom certificate and play man-in-the-middle.
As a web developer not much can be done other than disallowing HTTP requests. This can be done via mod_rewrite in Apache.
就足够了，因为如果它可以访问您的所有流量，那么无论您使用什么加密协议，他都可以在两种加密协议中使用中间人。
Is adequate, because if it have access to all your traffic, doesn't matter what encryption protocol do you use, he can use man in the middle for both encryption protocols.