保护 JavaScript 从不安全页面发出的 REST 调用
我们有一个基于网络的应用程序，我们不需要最终用户登录。该应用程序使用 Ajax 调用同一服务器上托管的 REST 服务。除了这个应用程序之外，我们希望确保如果任何其他应用程序/代理调用 REST 服务，它们都会被拒绝。
保护此类 REST API 安全的最简单方法是什么？我的猜测是，我们将包含某种安全令牌并通过 HTTPS 进行调用。但是我不清楚 Ajax 应用程序如何创建/获取/加密令牌以及生命周期通常是什么样的。
如果可能的话，我宁愿在 Spring Security 或 OAuth 之外执行此操作。我还读到通过 SSL 发送用户名和密码足以进行身份验证。在这种情况下，应用程序将有一个“用户名”和密码，并且它将随每个请求发送到 REST 服务。但是，如果客户端只是浏览器中的 HTML 和 javascript，那么如何保密该信息呢？
谢谢。
We have a web-based application in which we are not requiring end users to login. The application uses Ajax to make calls to REST services hosted on the same server. Besides this application, we want to make sure that if any other applications / agents call the REST service they get denied.
What is the simplest way to secure a REST API like this? My guess is that we would include some sort of security token and make the call through HTTPS. However I'm not clear how the Ajax application would create/obtain/encrypt the token and generally what the lifecycle looks like.
I would rather do this outside of Spring Security or OAuth if possible. I have also read that sending username and password over SSL is enough for authentication. In this case, the app would have a "username" and password and it would send it with every request to the REST service. But how would it keep that information secret if the client is just HTML and javascript in the browser?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
一般来说这是不可能的。有人可以在你的 JavaScript 上查看源代码，读取令牌，然后做任何他们想做的事情。
https 在这里不是必需的。对于令牌，最简单的方法可能是在从服务器下载 javascript 时设置 cookie，然后该 cookie 也将随任何 AJAX 请求一起传输。
这并不是真正安全 - 任何人都可以看到 cookie 是什么并使用它，但这是你能做的最好的事情。
In general this is impossible. Someone could just do view source on your javascript, read the token, then do whatever they want.
https is not necessary here. For the token, probably the easiest is to set a cookie when they download the javascript from the server, then that cookie will also be transmitted with any AJAX requests.
This is not really secure - anyone can just see what the cookie is and use it, but it's the best you can do.