PHP、PCI 合规性问题：如何？
我对 PCI 合规性有疑问。基本上，他们希望我在存在 password 字段的每个页面上添加 https:// 。这有点奇怪。
我在 index.php 中的表单如下所示：
<form method=post action="login.php" id="login">
<input type="text" size="16" maxlength="30" name="login" id="login_user" />
<input type="password" size=16 maxlength="20" name="pass" class="ifield" id="login_pass"/>
<input name="msubmit" type="submit" value="Login" />
</form>
我尝试发布到 https:
我应该如何解决这个问题？
I've have a problem with the PCI compliance. Basically they want me to add https:// on every page where the password field is present. this is kind of wierd.
My form in index.php looks like:
<form method=post action="login.php" id="login">
<input type="text" size="16" maxlength="30" name="login" id="login_user" />
<input type="password" size=16 maxlength="20" name="pass" class="ifield" id="login_pass"/>
<input name="msubmit" type="submit" value="Login" />
</form>
I've tried to post to https: <form method=post action="https://test.com/login.php" id="login"> but the test it still fails.
How should I fix this problem?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
首先，您需要配置您的网络服务器以支持 SSL。您将需要购买 SSL 证书并配置您的网络服务器以应答端口 80 和端口 443 上的请求。
完成这些更改后，您将能够告诉您的表单通过 URL 发布到您网站的 SSL 版本你在上面发帖了。
如果合规性规则需要，您可能还需要使表单本身在站点的 SSL 版本下加载。在这种情况下，您可以更新表单的所有链接以指向“https://”版本，或修改网络服务器规则以将对表单的所有请求转发到“https://”版本。
First, you will need to configure your webserver to support SSL. You will need to purchase an SSL certificate and configure your webserver to answer requests on both port 80 and port 443.
After you have completed these changes, you will be able to tell your form to post to the SSL version of your site via the URL you posted above.
If the compliance rules require it, you may also need to make the form itself load under the SSL version of the site. In this case, you can update all of your links to the form to point to the 'https://' version, or modify your webserver rules to forward all requests for the form to the 'https://' version.
从客观安全（而非 PCI）的角度来看，直接填写表格，然后通过 SSL 将其发布到 https 地址并没有什么问题。最初显示空白表单的页面是否是安全页面无关紧要，尽管许多人不这么认为（错误地）。在安全页面上展示您的表单就是一种营销——当您这样做时，人们会感觉更舒服。通过 https 提交才是真正的安全部分。
许多 PCI 合规性要求都是假设的或与营销和安全认知有关，而不是实际的安全性。如果您的扫描仪只是因为表单显示在非 SSL 页面上而对您进行标记，那么您可以合法地对该发现提出异议，因为这不会产生安全影响。如果有问题的表单，即使正确访问，也不允许访问服务器管理或私人信息，那么您也可以合法地对调查结果提出异议。但是，如果登录过程允许访问个人信息或服务器管理，则有多种原因需要确保通过安全端口提交。
From an objective security (not PCI) standpoint, there is nothing wrong with filling in the form as you have it, then posting it via SSL to an https address. Whether the page on which the blank form was originally displayed was a secure page is irrelevant, though many people think otherwise (wrongly). Presenting your form on a secure page is marketing -- people feel more comfortable when you do so. Submitting it via https is the actual secure part.
Many PCI-compliance requirements are hypothetical or about marketing and the perceptions of security, as opposed to actual security. If your scanner is flagging you simply because the form is being presented on a non-SSL page, then you could legitimately dispute that finding, as there is no security impact. If the form in question, even when properly accessed, doesn't allow access to server management or private information, then you could also legitimately dispute the finding. However, if the process of logging in allows access to personal information or server management, then there are multiple reasons to make sure that it is submitted via a secure port.