缓存/安全问题
最近，当我登录一家非常知名的移动电话运营商网站查看我的帐户时，我看到了一个完全不相关的帐户。刷新页面后，我看到了正确的帐户。
由于其他用户不使用该计算机，因此未从先前的会话中缓存它。
我知道发生这种情况的确切原因无法被发现，但我想知道这种情况可能发生的哪些可能的方式。我只能想到网络上的缓存问题，它错误地向我传递了最近使用该网站的其他人的页面。
所描述的情况还有哪些其他可能的方式发生？为什么这可能？这难道不是值得担心的事情吗？
Recently when I logged in to view my account on a very well-known mobile phone operators' site I was presented with an entirely unrelated account. After I refreshed the page I was shown the correct account.
It wasn't cached from a previous session as other users do not use the machine.
I understand that the exact reason for why this happened can't be discovered but rather I'm asking of which possible ways this situation can happen. I can only think of a caching issue on the network, which mistakenly passed me the page of someone else who recently used the site.
What other possible ways may the described situation happen? Why is this possible? Is this not something to be worried about?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不能代表任何其他平台，但在 ASP.NET 中，有一种技术可以实现类似的效果，即输出缓存。一旦传入的请求被 Web 服务器完全处理和呈现，生成的 HTML 就会缓存在服务器的内存中，并且服务器认为针对同一页面的任何进一步请求都会得到满足通过页面的缓存版本。
这是一种提高网站可扩展性的强大技术，但您必须小心如何应用它（并测试它！），否则您最终会遇到这种情况，人们开始看到其他人帐户的详细信息 - 我听说过银行网站上发生过这种情况。
你如何解决它？在
OutputCache页面指令中，有许多VaryBy...属性，可以设置这些属性来控制服务器生成页面的新版本的情况集VS 服务来自缓存的请求，例如为每个唯一的查询字符串缓存页面，基于内容编码缓存页面。在 ASP.NET WebForms 中，还有一个鲜为人知的控件，称为Substitution，它允许您将内容动态插入到输出缓存页面中。MSDN 参考
I can't speak for any other platform but in ASP.NET there's a technique that can lead to something like this, which is output caching. Once an incoming request has been completely processed and rendered by the web server, the generated HTML is cached in memory on the server, and any further requests that the server considers to be for the same page, are fulfilled by the cached version of the page.
It's a powerful technique for increasing the scalability of a site but you've got to be careful how you apply it (and test it!) or else you end up in this sort of situation where people start seeing details of other people's accounts - I've heard of this happening on banking sites.
How do you fix it? In the
OutputCachepage directive, there's a number ofVaryBy...attributes that can be set to control the set of circumstances under which the server generates a new version of the page vs serving the request from the cache e.g. caching a page for each unique querystring, caching pages based on content encodings. In ASP.NET WebForms, there's also a little-known control calledSubstitutionwhich allows you to dynamically insert content into an output-cached page.MSDN References