Codeigniter 中内置网站的启动前安全检查表
在启动使用 Codeigniter 构建的网站之前，应该检查哪些安全问题？我的网站的功能是登录、表单处理、限制页面等。这是一个学生舱的预订系统。请随意撰写有关一般安全问题的文章。
Before launching a site built in Codeigniter, what kind of security issues should one check for? What my site features is login, form handling, restricting pages, etc. It is a booking system for student cabins. Feel free to write about general security issues.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
首先，没有一个网站是 100% 安全的，最大安全性通常不是目标。这是安全性和可用性之间的权衡。如果您实际上并未在网站上接受订单并处理存款或付款，则您的需求会有所减少。这是一个开始：
基本前提是拒绝与预订部分相关的一切，直到完成适当的授权和身份验证，然后允许访问您网站的该部分。不确定您的网站是如何设计来实现此目的的。
删除所有打印详细错误信息或显示开发期间使用的会话或变量数据的代码。
验证所有表单输入都经过验证。
重新检查您授予用户、访问者和管理员的 mySQL 权限。用户应该只有 SELECT、INSERT 和 UPDATE。访问者只需选择。
验证密码是否未以明文形式存储。
您允许上传文件吗？如果是这样，需要防止远程文件包含攻击。
您是否在 Codeigniter 中启用了 CSRF 以防止 CSRF 攻击？
这是一个开始。我相信其他人可以添加他们的经验。
First of all, no web site is 100% secure and maximum security is typically not the goal. It is a tradeoff between security and usability. If you are not actually taking orders on your site and dealing with deposits or payments, your needs are somewhat less. Here's a start:
Basic premise is to deny everything to do with the booking portion until proper authorization and authentication is done and then allow access to that portion of your site. Not sure how your site is designed to accomplish this.
Remove all code that printed detailed error information or showed session or variable data used during the development.
Verify all form input goes through validation.
Re-check what mySQL permissions you give your users versus visitors versus the admin. User should just have SELECT, INSERT and UPDATE. Visitor just SELECT.
Verify passwords are not stored as plaintext.
Do you allow uploaded files? If so, need to prevent Remote File Inclusion attacks.
Did you enable CSRF in Codeigniter to prevent a CSRF attack?
That's a start. I am sure others can add their experience.