哪种参数传递方式更安全：URL、隐藏字段还是 cookie？
我正在使用 Intraweb，它为我提供了 3 个传递参数的选项。
- 在 url 中使用
?param - 使用隐藏字段
- 使用 cookies
就我的代码而言，我选择哪个选项并不重要，框架将我从中抽象出来。
但是，哪一种更能防止用户篡改呢？
I'm using intraweb and it gives me 3 options for passing parameters.
- Using a
?param in the url - Using hidden fields
- Using cookies
As far as my code is concerned which option I choose doesn't really matter, the framework abstracts me from that.
But, which one is more secure against tampering by the user?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
在 URL 参数中传递数据存在超出 URL 长度限制的风险，并且可能会干扰书签（或成为一项功能！）。作为 cookie 传递存在用户关闭 cookie（或客户端不支持 cookie）的风险。作为隐藏字段传递是最可移植的。
这些方法本身都不提供任何级别的安全性。
编辑： lance 指出的优秀文章中的一个建议是将敏感数据存储在服务器上，并且只向客户端传输 cookie。这是术语 cookie 的不同用法，更正确的说法应该是 会话 ID，它可以使用这三个中的任何一个在服务器和客户端之间来回传输您正在考虑的方法。
Passing data in URL parameters risks exceeding the length limit on URLs and can interfere (or be a feature!) with bookmarks. Passing as cookies risks the user having turned cookies off (or the client not supporting cookies). Passing as hidden fields is the most portable.
None of the methods in themselves provide any level of security.
EDIT: One suggestion in the excellent article that lance pointed to is to store your sensitive data on the server and only transmit a cookie to the client. This is a different use of the term cookie and should more properly be called a session id, which can be transmitted back and forth between the server and client using any of the three methods you are considering.
它们都可以使用免费工具轻松复制/修改，所以我想说使用最适合您的应用程序的 - 它们在安全性方面是相同的，它们都不应该被信任。
考虑使用服务器端发布的加密哈希来防止篡改您选择的任何选项。
They are all easily duplicated / modified using freely available tools, so I would say use whichever suits your application the best - they are equivalent in terms of security, none of them should be trusted.
Consider using a crypto hash issued by the server-side to prevent tampering whichever option you go for.
从安全角度来看，所有这些在服务器上都应该被同等对待。仅仅因为变量是通过 Piglet Transfer 而不是 GET 传递的，并不意味着它是安全的。它仍然来自邪恶的用户。
因此，请确保对所有这些都使用完全相同的安全机制。
From the security point of view, all of them should be treated the same on the server. Just because a variable is passed through pigeon transfer instead of GET, that doesn't mean it's safe. It's still coming from the evil user.
So make sure you use the exact same safety mechanisms for all of them.
它们都不安全（尽管不清楚您到底指的是哪种安全）。
当然，一个明显的区别是 url 参数始终可见 - 如果用户创建书签或向某人发送 URL，则该参数也会随之而来。
None of them are secure (though it's not clear what kind of security you mean exactly).
One obvious difference of course is that url params are always visible - if a user creates a bookmark or sends an URL to somebody, the parameter goes with it.
对于已经说过的内容，我想补充一点，当您在网址中有参数时，它可以让用户创建书签 - http://bikes.com/catalog.aspx?category=downill [不是真实地址]。因此，在某些情况下，这可能比其他两种选择更好。
To what is already said I would like to add that when You have params in url it let's user create bookmarks - http://bikes.com/catalog.aspx?category=downill [not real address]. So that may be better in some cases then the other two options.