安全性背后的代码 ASP.NET .CS
我是 Web 编程新手，对 ASP.NET C# 中的代码隐藏有疑问。别人看到里面的东西有多安全？我问的原因是我链接该网站的程序要求我创建一个接受我的管理员凭据的对象（它在后台执行此操作数千次，否则我只会提示输入凭据）。它使用凭据动态创建事物。我 99.99% 确信将我的凭据硬编码到页面中是非常不安全的，但我想我会问。
I'm new to web programming and have a question about code behind in ASP.NET C#. How safe is it from someone seeing what's in it? The reason I ask is the program I'm linking this website to requires me to create an object that takes in my admin credentials (It does this in the background thousands of times or I would just prompt for creds). It uses the credentials to create things dynamically. I'm 99.99% sure this is highly unsafe to hard code my credentials into the page but I figured I would ask.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
文件背后的代码和原始 aspx 文件受到保护，不会被 Web 服务器检索，因此只要您控制对服务器的控制台和文件共享访问，就相对安全。
尽管如此，它并不被认为是真正安全的。您应该将站点的应用程序池设置为在特定帐户下运行，然后授予该帐户必要的权限。使用普通用户帐户提供服务被认为是不好的做法。每个服务都应该有自己的帐户，并具有尽可能少的权限。
The code behind files and raw aspx files are protected from being retrieved by the web server, so as long as you control console and file share access to the server you are relatively safe.
Still, it is not considered really safe. You should set up the application pool of the site to run under a specific account and then give that account the necessary rights. Having services using ordinary user accounts is considered bad practice. Each service should have its own account, with least possible rights.
ASP.NET 页面在通过 HTTP 发送页面之前进行编译。这是安全的。但是，如果用户可以访问文件系统，那么您就会遇到另一个问题。
ASP.NET pages are compiled before sending the page over HTTP. This is secure. But if the user can access the file system, you have another problem on your hands.
您应该将凭据放入 web.config 中（或者您可以将它们移动到单独的文件中，例如 AppSettings.config 或 ConnectionStrings.config 等）。服务器
将永远不应该提供这些服务。这可能会有所帮助：
http://msdn.microsoft.com/en- us/library/4c2kcht0(v=VS.100).aspx
这告诉您如何进一步加密这些内容，以便它们不存储纯文本密码等：
http://weblogs.asp.net/scottgu/archive/2006 /01/09/434893.aspx
You should put your credentials in your web.config (or you can move them into separate files like AppSettings.config or ConnectionStrings.config etc). The server
willshould never serve these.This might be helpful:
http://msdn.microsoft.com/en-us/library/4c2kcht0(v=VS.100).aspx
This tells you how you can can go one step further and encrypt these so they do not store plain text password etc:
http://weblogs.asp.net/scottgu/archive/2006/01/09/434893.aspx
这是“安全”的。 IIS（默认情况下）不提供 .cs 文件。
另一种选择是预编译站点，然后将 .aspx 文件拖放到 Web 服务器上。
It is "safe". IIS (by default) does not serve up .cs files.
Another option is to precompile the site and then just drop the .aspx files on the web server.
默认情况下，将敏感信息放入 ASP.NET 中的 .cs 文件中并不是一个有风险的过程，因为 ASP.NET 不允许从客户端访问 .cs 文件（如果您不明确更改它），但是，请确保如果存在服务器错误，自定义错误报告模式不会将代码行发送到客户端（这在调试时非常有用，而当您向公众发布它时风险极大），或者任何人都可能能够读取您的敏感信息异常情况时的信息扔在那些线附近。
Putting sensitive information into .cs files in ASP.NET is by default not a risky process as ASP.NET does not give access to .cs files from the client side (if you don't change it explictly), however, be sure that if there is a server error, custom errors reporting mode does not send the lines of the code to the client (which is extremely useful when debugging, and extremely risky when you release it to the public) or anyone may be able to read your sensitive information if an exception is thrown near those lines.
这里有不同级别的“安全”。
是的，IIS 配置为不提供 .cs 文件或 .config 文件。也就是说，有 攻击向量已被证明可以成功让 IIS 将这些文件传递到邪恶者手中。
首先，我不会将 .cs 文件部署到服务器。如果可能，将网站转换为 Web 应用程序并部署已编译的版本。当然，.net 代码可以反编译 (反编译)。 com/products/decompiling.aspx" rel="nofollow noreferrer">和此处）；所以你还应该研究混淆。然而，即使混淆的代码可以被反编译，但通常更难读。 ;)
请注意，每个级别并不是真正“安全”。它只会让事情变得更加困难。
真正的答案是根本不将凭据存储在服务器上，并要求客户端通过加密传输提供它们。当然，您可以将它们缓存在内存中，但即使 事实证明，对于那些有物理访问权限的人来说是不安全的。
归根结底，问问自己这些密钥的价值有多大，以及您可以投入多少金钱/时间来保护系统。通常在某处存在平衡。
There are various levels of "safe" here.
Yes, IIS is configured to not serve up .cs files or .config files. That said, there are attack vectors which have proven successful in getting IIS to deliver those files into the evil doers hands.
First off, I wouldn't deploy .cs files to the server. If possible convert the web site to a web application and deploy it compiled. Of course, .net code can be decompiled (and here); so you should also look into obfuscation. However even obfuscated code can be decompiled but it's generally harder to read. ;)
Note that each level isn't really "secure". It just makes it more difficult.
The real answer is to not store the credentials on the server at all and require them to be provided by the client over an encrypted transport. Certainly you could cache them in memory, but even that has proven insecure to those with physical access.
At the end of the day, ask yourself how valuable the keys are and how much money/time you can invest in securing the system. There's usually a balance somewhere.