将授权和安全性应用于 RIA
我正在考虑创建传统 Web 应用程序的 RIA 版本。在传统的 Web 应用程序中，大部分代码都在服务器上，显然与客户端脱节。在那里，我至少会有条件代码来检查当前用户是否有权执行某些操作，或者要显示哪些表单字段。 在 RIA 中，所有代码都在浏览器中运行。所以我看来有两个选择。
- 如果我需要显示表单，请从服务器动态获取它。这是可行的，但它使服务器做更多的工作，而不仅仅是来回编组 JSON。
- 从服务器带回账户数据，并在客户端执行所有授权代码。我在 Basecampmobile 快速浏览了一下，他们似乎正在做类似的事情。 我的问题是，将这些信息隐藏在闭包后面是否真的可以保护它，或者这是“默默无闻的安全”？
I'm thinking about creating an RIA version of a traditional web application. In a traditional web app, most of the code is on the server, obviously, out of touch of the client. There I would have, at very least, conditional code to check if the current user has permissions to do something, or what form fields to display.
In a RIA, all code is running in the browser. So I have, it seems, two choices.
- If I need to display a form, grab it dynamically from the server. This works, but it makes the server do more work than just marshal back and forth JSON.
- Bring back the account data from the server, and do all authorization code on the client. I took a quick peak at basecampmobile, and seems they are doing something like this.
My question is, does hiding this information behind a closure really protect it, or is this "security by obscurity"?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我会在服务器和客户端上进行授权。客户端向服务器进行身份验证，服务器仅返回属于该客户端/用户的数据，不返回任何其他数据。然后在客户端上检查具体授权以相应更新 UI。
请记住，您始终可以进入开发工具并查看网络流量，因此我们在这里甚至不讨论模糊性......
I would do authorization on the server and the client. The client authenticate with the server and the server returns only data belonging to that client/user nothing else. Then on the client you check the authorization on specifics to update the UI accordingly.
Remember you can always jump into the dev tools and see the network traffic so we are not even talking about obscurity here...
当您在胖客户端上工作时，您应该检查服务器和客户端上的用户安全性，因为客户端很容易被黑客攻击。
我不喜欢 RIA 服务基于角色的授权。使用像 SQL Server 那样的基于访问的授权感觉更直观，并且它不会强迫您在客户端重新实现安全性。例如，与其说 x、y 和 y 可以访问此 createCustomer(..) 方法，不如说具有“Create”权限的人可以访问此方法会更直观。
我有一个开源框架可以促进这种类型的授权在此处了解更多信息。它被称为安全框架。
When you work on a thick client, you should check for user security both on the server and client because client can be hacked easily.
I don't like RIA services role based authorization. It feels much more intuitive to use access based authorization like what SQL Server has, and it doesnt force you to re-implement the security at client side. For example instead of saying x, y, and y can access this createCustomer(..) method, it is more intuitive to say someone with the "Create" right can access this method.
I have an open source framework that faciliates this type of authorization read more here. It is called saf-framework.