Grails 如何处理安全性，以及为什么应该使用插件？
对于每个与安全相关的 Grails 教程，90% 的内容都会告诉您将 User 对象存储在会话范围的变量中。这一切都很好很简单，但我想知道这是否好得令人难以置信，尤其是像 这样的插件Spring Security 提供了更多倍的功能。
对于简单的“我是用户，因此我有权查看/编辑我自己的域对象”我开发的应用程序，我将我的用户对象存储在会话中。然而，这让我思考 Grails 如何在其自己的实现中支持 J2EE 安全性和会话（它确实在 cookie 中使用临时会话 ID，对吧？）。此外，它有多容易受到 cookie 注入和跨站点/杂散 JS 等攻击？
我不想真正投入时间来学习、集成和维护可能不需要它的应用程序的插件，所以我的问题是，Grails 的会话实现对于简单的应用程序来说是否足够安全，是否有一个很好的理由即使对于这些琐碎的任务，我也应该使用安全插件吗？
顺便说一句，如果有人能给我指出一个好的 OpenID/Facebook 登录实现，那就太好了。
For 90% of every security-related Grails tutorial, they tell you to store your User objects in a session-scoped variable. That's all nice and easy, but I wonder if it's too good to be true, especially with plugins like Spring Security that offer many times more features.
For the simple, "I am a user and therefore I am entitled to view/edit my own domain objects" applications that I develop, I store my User objects in a session. However, this got me thinking how Grails supports J2EE security and sessions in its own implementation (it does use a temporary session ID in the cookie, right?). Furthermore how vulnerable is it to attacks like cookie injection and cross-site/stray JS?
I don't want to actually invest the time in learning, integrating, and maintaining a plugin for an app that might not need it, so my question is, is Grails's session implementation secure enough for simple applications, and is there a very good reason I should use a security plugin even for these trivial tasks?
On a side-note, if anyone can point me to a good OpenID/Facebook login implementation, that would be terrific.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
关于安全问题，我始终建议选择经过验证且广泛采用的解决方案，而不是您自己的滚动安全实施。 Spring Security 成立于 2003 年，名称为 Acegi，为您带来超过八年的安全经验和开发经验。
正如您已经指向 Grails Spring Security 插件一样，您应该看看OpenID 插件 Spring Security OpenID 扩展了 Spring Security Core 并为您带来 OpenID 支持。
Regarding security concerns I would always suggest to prefer proven and widely adopted solutions over your own rolled security implementation. Spring Security was founded in 2003 under the name Acegi and brings you more than eight years of experience and development for your security concerns.
As you already pointed to the Grails Spring Security plugin you should have a look at the OpenID plugin Spring Security OpenID which extends the Spring Security Core and brings you the OpenID support.
...在基本层面上，使用该插件也很简单，那么有什么损失呢？ 屏幕录像帮助您入门
... on a basic level it's also trivial to use the plugin so what's there to lose? Screencast to get you started