ASP.NET 中的 CustomerId 和 Request.QueryString
Request.QueryString 不太安全。万一有人登录。 只需输入 URL，
myaccount.aspx?custId=10
即可获取另一客户的信息。
所以它根本不安全。发布此内容的原因是，我想要一种在页面之间传递 customerId 的替代方法。也许加密它？
Request.QueryString is not very safe. Incase someone is logged in.
Just by typing in the URL
myaccount.aspx?custId=10
One can get the information of another Customer.
So its not safe at all. The reason for posting this was because, I wanted an alternative way of passing customerId between pages. Perhaps encrypt it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
实际上，对于 myaccount.aspx，您不需要用户将其 ID 作为参数传递。
正如其他人所说，使用会员资格。或者创建用户 ID 和密码的哈希值（加密值）并将其保存为 cookie 或会话对象中。您可以读取它而不是输入参数。
Really for myaccount.aspx you shouldn't need to a user to pass their ID in as a parameter.
As others have said, use Membership. Or create a hash (an encypted value) of a user's ID and password and save that as a cookie or in the session object. You can read that instead of an input parameter.
查询字符串安全并且没有缺陷。
有缺陷且不安全的是信任用户输入数据。您有责任验证发送到服务器的数据不是恶意的，并且登录用户是否允许所请求的操作。
您应该采用该查询搅拌值，确保它是有效类型（您的示例似乎是整数），然后在获取客户数据之前，确保允许用户访问该客户数据。
Query strings are safe and are not flawed.
What is flawed and unsafe is trusting user input data. It is your responsibility to verify the data being sent to the server is not malicious and that the requested action is allowed for the logged in user.
You should take that query stirng value, make sure it is the valid type (your example appears to be an integer) and then before fetching the customer's data, make sure the user is allowed to access that customers data.
这不是
QueryString的责任。您应该实现一个身份验证和授权系统，最好使用MembershipProvider和RolesProvider。That's not the responsibility of the
QueryString. You should implement an authenication and authorization system, preferably with aMembershipProviderandRolesProvider.它做了它应该做的事情。确保您的网站安全取决于您。没有人说查询字符串中的所有内容都用于敏感访问相关功能。
It does what it's supposed to do. It is up to you to secure your site. No one said everything in the querystring is used for sensitive access related functionality.
没有安全的方法可以通过它。用户登录后，将 ID 存储在 Session 或类似的内容中，然后始终从那里获取它。
There is no safe way to pass it. Once the user has logged in, store the ID in Session or something equivalent, then always take it from there.
您可以检查 asp.net 成员身份
You can check asp.net membership
您应该使用 ASP.NET 安全 对客户进行身份验证和授权，以便检查登录用户是否有权访问查询字符串中指定的客户 ID。
You should be using ASP.NET security to authenticate and authorize customers so that the logged in user is checked to see if they have access to the customer ID specified in the query string.