Web 服务的垃圾邮件能力和安全性
我正在构建一个 ASP.NET Web 应用程序，该应用程序有许多表单供公共用户注册并输入要保存到数据库中的数据。我一直想更深入地了解真正的 AJAX，因此我将许多事务编写为 RESTful WCF Web 服务。新用户注册、用户登录和简单表单提交等事务都是通过 AJAX 完成的。
在进行代码审查后，一名团队成员反对这种方法，理由是：
“它的安全性不如完全回发，因为 .NET 具有像 ViewState 这样的‘安全措施’来防止滥用客户端攻击服务器。”
- 这个论点有道理吗？
- 使用 RESTful Web 服务使我的应用程序遭受滥用的风险比使用完整回发的情况要多得多？
我不一定要寻找 . NET、WCF 甚至 ViewState 的特定响应，尽管这些响应肯定与我的特定情况更相关。我正在寻找解决技术方法本身的答案，而不是它们的实现。可以在不验证授权的情况下修改任何用户帐户的 Web 服务显然是一个糟糕的实现。 “完整回发”页面的实现同样很差。因此，这个论点既不存在，也不存在。
RESTful Web 服务（或一般的 Web 服务）是否存在任何固有的因素导致它们比传统的 .net 回发更不安全？
I am building an ASP.NET web application that has numerous forms for public users to sign up and enter in data to be saved into a database. I've always wanted to dig a little deeper into true AJAX so I have writing many of the transactions as RESTful WCF web services. Transactions like new user registration, user login and simple form submissions are all done via AJAX.
Upon a code review a team member objected to this approach on the basis that,
"it is less secure than full postbacks because .NET has 'security measures' like ViewState to prevent abusive clients from hammering the server."
- Does this argument have merit?
- How much more am I exposing my application to abuse by using RESTful web services than If I used full postbacks?
I'm not necessarily looking for .NET, WCF or even ViewState specific responses though those will certainly be more relevant to my particular situation. I am looking for answers that address the technical approaches themselves - not the implementations of them. A web service that can modify any user account without validating the authorization is obviously a bad implementation. A "full postback" page can have an equally poor implementation. Therefore this argument would be neither here nor there.
Is there anything inherent to RESTful web services (or web services in general) that make them more insecure than a traditional .net postback?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您的团队成员不正确。
ViewState与安全性无关。事实上，RESTful Web 服务比 ASP.Net 页面性能更高，因为它们涉及的传输量更少，并且没有 ASPX (ViewState) 的开销。
但是，您确实需要防范 CSRF 攻击，这会导致ASP.Net 非 AJAX 模型可以缓解。
Your team member is incorrect.
ViewStatehas nothing to do with security.In fact, RESTful web services are more performant than ASP.Net pages, because they involve sending less down the wire, and because they don't have the overhead of ASPX (ViewState)
However, you do need to protect against CSRF attacks, which the ASP.Net non-AJAX model mitigates.