是否可以对 HTML5 应用程序缓存应用任何保护或限制？
（顺便说一句，我指的是应用程序缓存/清单；不是本地存储。）假设
我只希望特定用户能够使用应用程序缓存。当他们登录我的网站时，根据他们的权限，该网站会告诉浏览器获取清单。客人和没有特权的人无权查看清单。
为了规避此问题，恶意用户可以从其他用户的浏览器数据文件夹复制应用程序缓存文件，或直接下载清单文件。
有什么办法可以防止这种情况发生吗？有什么内置机制吗？
(I'm referring to application caches/manifests; not local storage, by the way.)
Let's say I want only specific users to be able to use an application cache. When they login to my website, depending on their privileges, the site tells the browser to grab the manifest. Guests, and those without privileges, are not given access to the manifest.
To circumvent this, a malicious user could copy the application cache files from another user's browser data folder, or directly download the manifest file.
Is there anyway to prevent this from happening? Any built-in mechanisms?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
仅可物理访问计算机，或者计算机已受到严重危害。但对于这些类型的攻击没有保护措施。当前的浏览器应该将应用程序缓存充分隔离到特定域。根本不允许跨域访问。
如果您有权访问服务器端，那么您可以在用户登录时自动生成清单。这样，每个清单对于用户来说都是唯一的，并且对于没有适当权限访问您的站点的任何人来说，不会存在可以直接下载的清单。
applicationCache 没有内置的安全机制。我在我的离线应用程序中考虑了这一点，我看到的唯一安全措施是缓存文件的加密。客户端加密不太理想，但您可以加密缓存文件的内容，并需要密钥在应用程序/页面启动时解密它们。上次我对此进行研究时，一些斯坦福大学学生提供的 JS 加密库是我发现的最好的。
Only with physical access to the machine, or if the machine has been severely compromised. But there's no protection against these types of attacks. Current browsers should sufficiently isolate application caches to specific domains. Cross-domain access is simply not allowed.
If you have access to your server-side, then you can auto-generate your manifests upon user login. This way, every manifest will be unique to the user, and no manifest will exist to be downloaded directly for anyone who does not have appropriate permissions to your site.
There's no built-in security mechanism for applicationCache. I've considered this in my offline apps, and the only security measure that I've seen is encryption of cached files. Client-side encryption is less-than-ideal , but you could encrypt the contents of your cached files and require a key to decrypt them upon application/page launch. Last time I researched this, the JS crypto library from a few Stanford students was the best I found.