如何制作“私人” RESTful 资源？
好吧，这可能是一个关于 REST 概念或 Rails 安全性的非常基本的问题，但请耐心等待。
我的主页中有一个谷歌地图，我想从我的数据库中的公司获取所有纬度/经度，以便我可以创建标记并显示它们。
因此，我创建了一个 http://mywebsite.com/companies/locations 的资源，它返回一个 json包含公司 ID 及其每个纬度经度的对象。
现在，这可能是正确的方法，但我一直有这种感觉，它有点太……暴露了？
我的意思是，任何人都可以在浏览器上输入该内容并获取我们拥有的所有公司。这听起来不太安全。
在我看来，有一种方法可以让 javascript ajax 调用来获取信息并将其“隐藏”在公众视线之外，或者这只是一种通过模糊来实现安全的情况？
我缺少什么共同知识吗？
谢谢。
Ok, so this is maybe a very basic question about REST concepts or Rails security in general, but bear with me.
I have a google map in my main page, I would like to get all the latitudes/longitudes from the companies in my DB so I can create the markers and show them.
So, I created a resource that's http://mywebsite.com/companies/locations, it returns a json object with the company ids and each of their latitude longitudes.
Now, this is probably the right way to do it, but I keep getting this feeling that its a bit too... exposed?
I mean, anyone could just type that on the browser and get all the companies we have. That doesn't sound very secure.
In my mind there would be a way for only that javascript ajax call to get the information and "hide" it from the public eye, or is this just a case of security through obscurity?
Is there a common piece of knowledge I'm missing or something?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的。阅读 HTTP 身份验证。观看有关 Rails 中 HTTP 身份验证的截屏视频。
还有其他方法可以使用 REST 进行身份验证，但这是最“自然”且标准化的一种。
[编辑]抱歉，请重新阅读您的问题。如果您需要向用户显示数据，则绝对没有办法隐藏它。无论您采用哪种晦涩的方式来隐藏 URL，都可以使用 Firebug （例如）轻松捕获请求，与响应数据。
[编辑 2] 好吧，您可以在服务器端加密数据，然后在 Javascript 中对其进行解密，但解密代码仍然可供任何人使用。此外，我相当确定您可以从调试控制台获取 Google Maps 对象并从中读取地标。
Yes. Read up on HTTP authentication. Watch the screencast on HTTP authentication in Rails.
There are other ways to do authentication with REST, but this is the most 'natural' and standardized one.
[EDIT] Sorry, re-read your question again. If you need the data to be displayed to a user, there is absolutely no way to hide it. Whichever obscure way you'd make up to hide the URL, the request could be easily captured using Firebug (for example), along with the response data.
[EDIT 2] Well, you could encrypt the data serverside and then decrypt it within Javascript, but still the decrypting code is available to anyone. Besides, I'm fairly sure you can get the Google Maps object from the debug console and just read the placemarks from it.
任何需要发送到客户端浏览器的数据（即 JavaScript 使用的任何数据）都容易受到攻击。没有办法可靠地保护此类数据。
Any data that needs to be sent to the client browser (i.e. anything to be used by JavaScript) is vulnerable. There is no way to reliably protect such data.