在node.js中我如何遵循最小权限原则？
想象一个执行两个主要功能的 Web 应用程序：
- 从需要较高权限的文件中读取
- 数据 从需要较低权限的文件中提供数据> 读取权限
我的假设：要允许读取这两个文件，我需要使用可以读取这两个文件的帐户来运行节点。
如果节点在可以访问这两个文件的帐户下运行，则由于 Web 应用程序代码中的安全缺陷，不应能够读取任何需要更高权限的文件的用户可能会读取这些文件。这将在我想象的 Web 应用程序世界中导致灾难性的后果。
理想情况下，节点进程可以使用最少的权限集运行，然后在访问系统资源之前临时升级这些权限。
问题：节点可以临时提升权限吗？或者有更好的方法吗？
如果没有，我正在考虑运行两台不同的服务器（一台具有较高权限，另一台具有较低权限），然后将它们都放在代理服务器后面，该代理服务器在转发请求之前进行身份验证/授权。
谢谢。
Imagine a web application that performs two main functions:
- Serves data from a file that requires higher privileges to read from
- Serves data from a file that requires lower privileges to read from
My Assumption: To allow both files to be read from, I would need to run node using an account that could read both files.
If node is running under an account that can access both files, then a user who should not be able to read any file that requires higher privileges could potentially read those files due to a security flaw in the web application's code. This would lead to disastrous consequences in my imaginary web application world.
Ideally the node process could run using a minimal set of rights and then temporarily escalate those rights before accessing a system resource.
Questions: Can node temporarily escalate privileges? Or is there a better way?
If not, I'm considering running two different servers (one with higher privileges and one with lower) and then putting them both behind a proxy server that authenticates/authorizes before forwarding the request.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这确实是一个棘手的案例。最终文件权限是一种元数据。我的建议不是直接访问文件，而是以数据库表的形式在文件之间建立一些层，或者任何可以将用户类型映射到文件的东西，并将文件流式传输给用户（如果存在）。
这意味着所谓的 Web 应用程序不能简单地规避文件系统权限。您甚至可以将其设置为使所述文件没有服务器可读权限，而只能由中间层读取。它所能做的就是拨打电话，看看具有给定权限的用户是否可以访问这些文件。如果您选择的话，您还可以在多个 Web 应用程序之间共享。另外，由于中间层的作用非常具体，您可以强制执行一组非常有限的调用。
现在，如果权限较低的用户以某种方式获得了权限较高的用户帐户的访问权限，他们将能够看到该文件，并且没有办法真正解决锁定用户帐户的问题。但这是开发过程的一部分。
This is a tricky case indeed. In the end file permissions are a sort of meta-data. Instead of directly accessing the files, my recommendation would be to have some layer between the files in the form of a database table, or anything that could map the type of user to the file, and stream the file to the user if it exists.
That would mean that the so called web application couldn't just circumvent the file system permissions as easy. You could even set it up so that said files did not have server readable permissions, and instead were only readable by the in between layer. All it could do is make a call, and see if the user with given permissions could access the files. This lets you also share between multiple web applications should you choose. Also because of the very specific nature of what the in between layer does, you can enforce a very restricted set of calls.
Now, if a lower privileged user somehow gains access to a higher privileged user's account, they'll be able to see the file, and there's no way to really get around that short of locking the user's account. However that's part of the development process.
不，我怀疑 Node.js（开箱即用）能否保证最低权限。
可以想象，如果node.js以root身份运行，它可以通过系统调用来调整其操作系统权限以允许或限制对某些资源的访问，但再次以root身份运行将违背最初的目标。
一种可能的解决方案可能是运行节点的三个实例，一个代理（没有特殊权限）来将调用定向到以不同权限级别运行的一台或其他两台服务器。 （呵呵，正如你已经提到的。在加入战斗之前，我真的需要读完帖子的末尾！）
No, I doubt node.js-out of the box-could guarantee least privilege.
It is conceivable that, should node.js be run as root, it could twiddle its operating system privileges via system calls to permit or limit access to certain resources, but then again running as root would defeat the original goal.
One possible solution might be running three instances of node, a proxy (with no special permissions) to direct calls to one or the other two servers run at different privilege levels. (Heh, as you already mention. I really need to read to the end of posts before leaping into the fray!)