处理失败的随机数验证的最佳方法是什么？
我对随机数有一个模糊的理解，但有一点困惑。
当随机数验证失败时，正确的响应是什么？
什么情况下nonce验证会失败？真正的用户面临什么风险？
I have a vague understanding of nonces but have a little confusion.
What is the correct response when nonce validation fails?
Under what circumstances could nonce validation fail? what is the risk to genuine users?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
表单随机数的目标通常有两个：确保数据仅提交一次，并确保用户实际进行提交。第二点有助于防御跨站点请求伪造： http://en.wikipedia.org/wiki/ Cross-site_request_forgery
处理它们取决于上下文。如果用户正在填写表单并且随机数失败，请刷新页面（预填写数据），说一些良性的内容，例如“哎呀，出现问题，请检查您的输入并再次提交”。有效的用户可以点击提交，攻击将被挫败，或者至少让用户知道发生了什么。
验证可能会因多种原因而失败。如果您启用了某种形式的浏览器缓存，用户访问一个表单（具有给定的随机数），然后导航到另一个表单（具有自己的随机数）并通过后退按钮返回到第一个表单，随机数可能会失败。通过允许浏览器缓存发生，它们不会刷新页面，并且您的服务器可能只在会话中为它们存储一个有效的随机数，因此它们不会匹配。一个有效的用例和一个失败的随机数（不是一个我会失眠的，只需确保重新填充表单即可）。
总的来说，我的建议是：告诉用户再次提交，巧妙地暗示他们应该检查他们的输入，使再次提交变得容易。
The goal of nonces with forms is generally two fold: to ensure the data is only submitted once, and to ensure the user actually does the submitting. The second point helping defend against cross site request forgeries: http://en.wikipedia.org/wiki/Cross-site_request_forgery
Dealing with them depends on the context. If a user is filling out a form and the nonce fails, refresh the page (pre-fill the data), say something benign like "Oops there was a problem, please check your input and submit again". A valid user can hit submit, an attack will be thwarted, or the user at least made aware of what's happening.
Validation can fail for a few reasons. If you've got some form of browser cache enabled, a user visits one form (with a given nonce), then navigates to a different one (with it's own nonce) and returns to the first via the back button the nonce will likely fail. By allowing the browser cache to occur they haven't refreshed the page, and your server is likely only storing a single valid nonce for them in the session so they wont match. A valid use case, and a failed nonce (not one I'd lose sleep over, just make sure the form is re-populated).
By and large my recommendation would be: Tell the user to submit again, subtly imply they should check their input, make it easy to submit again.