ClickOnce - ActiveX 的安全替代方案，用于从 IE 启动本地应用程序？
需要在 Intranet 上运行 ASP.NET 页面来启动本地 Windows 应用程序 (VB6 exe)。最初计划使用 ActiveX 控件，但是 ActiveX 控件的一般安全问题（真实的和感知的）使我们考虑使用 ClickOnce 方法来解决该问题。用户单击将启动 ClickOnce 应用程序的链接（ClickOnce 应用程序只是一个用于启动 VB6 应用程序的 .NET Windows 应用程序）。从安全角度来看，这是更好的解决方案吗？
Need to have ASP.NET page running on intranet launch a local windows application (VB6 exe). Originally planning to use an ActiveX control, however general security concerns with ActiveX controls (real and perceptual) have led us to consider a ClickOnce approach to the problem. The user would click on a link that would launch the ClickOnce application (the ClickOnce application would just be a .NET windows app to launch the VB6 app). Is this a better solution from a security perspective?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是否有原因导致您无法简单地将要作为 ClickOnce 应用程序启动的应用程序发布？
发布 ClickOnce 应用程序时，它始终检查服务器是否有任何更新，如果没有更新，则启动应用程序的缓存安装。这与发布应用程序时生成的默认 ClickOnce 安装页面上的“启动”链接效果相同。您可以发布应用程序，然后将启动链接中的 URL 复制到您的网站，以获得相同的效果。
我不推荐你上面的方法。我不知道您的具体情况，但显然，如果用户计算机上不存在 VB6 应用程序或者它位于不同的安装位置，您上面提到的 ClickOnce 应用程序将无法工作。
针对您的安全问题，我不是 Active X 专家，但我认为如果在您的 Intranet 中使用 ActiveX 组件，启动它不会成为问题。事实上，我认为 ActiveX 的问题在于，当它启用时，恶意网站可以注入有害的 ActiveX 病毒。我不是安全专家，所以我可能是错的。然而，令我惊讶的是，托管 ActiveX 服务将是一个安全问题（假设您的代码是合法的；）
Is there a reason why you couldn't simply publish the application that you want to launch as a ClickOnce application?
When a ClickOnce application is published, it always checks the server for any updates and, if there are none, it launches the cached installation of the application. This is the same effect as the "launch" link on the default ClickOnce installation page that is generated when you publish the application. You could publish the application and then copy the URL from the launch link to your website for the same effect.
I wouldn't recommend your method above. I don't know your specific scenario but, obviously, your ClickOnce application that you mention above would not work if the VB6 application did not exist on the users computer or if it was located in a different installation location.
In response to your security concerns, I'm not an Active X expert but I wouldn't think launching an ActiveX component would be a problem if it's being used from within your intranet. In fact, I think the problem with ActiveX is when it's enabled, malicious websites can inject harmful ActiveX viruses. I'm not a security expert, so I could be wrong. I'd be surprised, however, that hosting an ActiveX service would be a security problem (assuming your code is legit ;)