允许安全表单数据发布到我的 Rails api
我正在创建一个 Rails 应用程序，它将帮助企业。这些企业拥有数千名员工，他们需要此应用程序的用户帐户。
我希望企业能够在其本地 Intranet 上实施一个表单，用户可以在想要注册我的应用程序时提交该表单。此表单将一些有关当前登录用户的半敏感字段发布到我的 Rails API，例如他们的姓名和电子邮件地址，这些字段将由他们的服务器端代码填充。
我可以使用此信息来帮助用户注册我的网站，并确定他们实际上属于哪个企业。然而，表单信息以及 API 密钥需要加密，以避免任何数据被盗或业务被欺骗。
有哪些加密方法可以在各种不同的语言和框架上实现，并且为企业实现的麻烦最少？
使用公钥和私钥加密的 OPEN SSL看起来确实是一个不错的选择，但这确实需要一些密钥的交换和创建，并且可能会变得复杂。有更简单的选择吗？
I am creating a rails app which will help out businesses. These businesses have thousands of employees who will need a user account on this app.
I would like the business to be able to implement a form on their local intranet which can be submitted by users when they want to sign up to my app. This form posts some semi-sensitive fields to my rails API about their currently logged in user, such as their name and email address which would be populated by their server side code.
I can use this information to aid in the process of signing the user up to my site, and in identifying which business they actually do belong to. However, the form information along with an API key will need encrypting to avoid any data being stolen or a business being spoofed.
What methods of encryption are there out there that can be implemented on a variety of different languages and frameworks, and that involve the least amount of fuss to implement for the business?
OPEN SSL with Public and Private key encryption does seem like a good choice, but this does require some exchanging and creating of keys and can get complicated. Are there easier options?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
为什么不直接让他们通过 TLS/SSL 发布到您的网站？他们可以包含他们的 API 密钥。 SSL 几乎是跨平台和跨语言的。任何合适的服务器端语言都可以发出 HTTP 请求，因此如果您希望它们从后端而不是直接从表单发送请求，那很容易。
Why not just have them post to your site over TLS/SSL? They can include their API key. SSL is about as cross-platform and cross-language as you can get. Any decent server-side language can make an HTTP request, so if you want them to send the request from their backend instead of directly from the form, that is easy enough.
您应该使用 SSL 来保护传输层以及内置的 Rails 表单保护（假设您可能使用自己的表单）。假设这是内网，您可以生成 SSL 证书并通过 https://
Edit1 运行您的 Rails 应用程序：
您还可以使用 OAuth/OpenID 推出完整的 API 来验证用户身份并授权其他应用程序。这完全取决于您是否拥有整个数据、用户和生态系统。
You should use SSL to secure the transport layer as well as built-in Rails form protection (assuming you might do your own forms). Assuming this is intranet, you can generate an SSL certificate and run your Rails app through https://
Edit1:
You can also roll out a full API with OAuth/OpenID to authenticate users and authorize other applications. It all depends on if you own the data, users and ecosystem overall.