我应该如何保护大部分静态的 Web 应用程序？
我正在自学网络开发。直到最近，我的应用程序只是与 Twilio 等第三方 API 进行通信，没有用户前端。我喜欢 CherryPy，因为它足够简单，不会妨碍我。
我想建立一个主要是静态的个人网站，具有一些动态功能。我计划使用 CherryPy 来提供 HTML 服务，并处理来自 jQuery 的 AJAX 请求，为电子邮件联系表单等提供交互式且可访问的 UI。
但是，我有一些安全问题。我有系统管理背景；所以我知道人们可能使用的各种攻击媒介（XSS/CSRF 等）。我还知道 CherryPy 不提供保护 我已经计划使用 reCaptcha 来保护联系表单的安全。我还能做什么？ Python/CherryPy 是否有提供一些基本过滤保护的表单库？是否有免费工具可以用来测试我的应用程序是否存在此类漏洞？
I'm in the process of teaching myself web development. Until recently, my applications have simply communicated with 3rd party APIs like Twilio, with no user front end. I like CherryPy because it is simple enough that it does not get in my way.
I'd like to build a mostly static personal site with some dynamic features. I plan on using CherryPy to to serve the HTML, and handle AJAX requests from jQuery, to provide an interactive and accessible UI for things like an email contact form.
However, I have some security concerns. I come from a system administration background; so I am aware of the various attack vectors one might use (XSS/CSRF, etc). I also know that CherryPy does not provide protection out of the box. I already plan on securing the contact form with reCaptcha. What else can I do? Is there a form library for Python/CherryPy that offers some basic filtering protection? Is there a free tool I can use to test my application for such vulnerabilities?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
reCaptha（和其他此类工具）不是为了安全，而是为了防止滥用。如果您的代码没问题，您将不需要验证码来保护您的网站，除非您想要一份全职工作来删除邮箱中的所有垃圾邮件。
我发现在邮件表单中添加一些自制的技巧比开箱即用的验证码效果要好得多。我在表单中添加了一个隐藏的输入字段，名为“电子邮件”。机器人会剥离您的页面并尝试在所有输入字段中输入合理的值。如果他们在此隐藏字段中输入一个值，您就可以确定您正在与机器人打交道。
我发现这个技巧出奇地有效。
reCaptha (and other such tools) are not for security, but for abuse-prevention. If your code is ok, you won't need a Capcha to protect your site, unless you want to have a fulltime job removing all the spam from your mailbox.
I found that adding a little home-made trick to your mail form works a lot better than an out of the box captcha. I've added an hidden input field to my form, named 'email'. Bots will strip your page and try to enter sensible values in all input fields. If they enter a value in this hidden field, you can be sure you're dealing with a bot.
I've found this trick working surpisingly well.
我建议基本身份验证，除非您希望外部用户访问它。否则，我会接受 GolezTrol 的建议。
I would suggest Basic Authentication unless you want external users to access it. Otherwise, I would take GolezTrol's advice.