Spring安全中的HTTP基本身份验证是否可以避免SQL注入
我在 Spring MVC 项目中使用 HTTP 基本身份验证。 Spring 的身份验证是否可以防止 SQL 注入？
有哪位专家可以对此作出说明吗？或者提供声明的链接。
I am using HTTP Basic Authentication in my Spring MVC project. Is Spring's authentication protected from SQL Injection?
Can any expert provide a statement on this? Or provide links to a statement.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
与 Simeon 一致，它与您应用于标准框架的任何底层自定义一样安全。
JdbcDaoImpl的标准框架实现使用PreparedStatement进行所有 JDBC 访问，这应该可以防止 SQL 注入攻击，即使您修改查询也是如此。然而，如果您扩展它或编写自己的实现，那么一切都将失败。从体系结构的角度来看，您的问题并不完全准确 - 传递身份验证凭据的方法（在您的情况下是基本的）不会直接影响实际到达数据库的内容。凭据的接收和验证之间存在良好的抽象层。我建议查阅 Spring Security 文档以了解为什么会这样。
In agreement with Simeon, it is as safe as any underlying customizations you have applied to the standard framework.
The standard framework implementation of
JdbcDaoImplusesPreparedStatements for all JDBC access, which should protect against SQL injection attacks, even if you modify the queries. If you extend it or write your own implementation, however, all bets are off.From an architectural perspective, your question is not entirely accurate - the method of passing authentication credentials (basic, in your case) doesn't directly impact what actually reaches the database. There is a good layer of abstraction between the receipt and verification of credentials. I would suggest consulting the Spring Security documentation to understand why this is so.
您如何检查用户凭据？
如果您使用 UserDetailsService 来根据数据库检查用户凭据，那么保护自己免受注入的责任就落在您身上，因为您正在构建查询。
How are you checking user credentials ?
If you are using a
UserDetailsServiceto check user credentials against a DB then the responsibility to protect yourself against injections falls to you, since you are building the query.