确保 Sinatra 应用程序安全的最佳实践是什么？
保护使用多种不同形式和 mongodb 作为数据库的 Sinatra 应用程序的最佳实践是什么？
What are the best practices to secure a Sinatra application that uses many different forms and mongodb as a database?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不确定您在寻找什么。以下是一些想法。
如果您想验证系统的用户，我建议使用在机架层运行的身份验证，例如 Warden。这不仅可能比自定义身份验证解决方案更强大，而且它作为中间件运行，因此它基本上是透明的，并且如果您决定向 Rack 堆栈添加其他中间件、自定义 Rack 应用程序或 Rails，则可以在 Sinatra 之外使用。
mongodb 的运行方式（命令与数据分离）意味着不太可能发生注入，因此对用户输入进行一些最低限度的健全性检查应该可以使数据库泄露的风险相当低。与任何数据库一样，最好的做法是，在没有适当的边界检查和转义的情况下，永远不要将用户的任何数据直接放入数据库中。
确保用户不能输入其他用户可以看到的 HTML/JS/CSS，否则您的网站可能容易受到 XSS 攻击。
如果可能的话，明确定义允许用户选择的所有可能输入，然后确保您从用户收到的输入与您定义的可能值之一完全匹配。如果不是，则拒绝输入或选择一个合理的默认值。
良好的单元测试和广泛的测试覆盖范围通常可以帮助减少意外行为，有时可以用来帮助防止安全问题。尝试一下。当然不会受伤。
另一个可以从侧面有益于安全的好做法是不要重新发明轮子。采用社区其他成员所依赖的经过验证的、可靠的、功能强大的解决方案，这样您就可以从其他人的见解中受益，并在其他人发现并修复您使用的库中的安全缺陷时获得回报。
您可能需要解决许多其他系统、数据库和应用程序级别的问题，以确保您的应用程序安全。如果不深入了解完整的系统架构，您的问题范围有点太宽泛，无法回答。
Not sure what you are looking for. Here are a few thoughts.
If you want to validate users of your system, I suggest using authentication that operates at the Rack layer, like Warden. Not only is this likely more robust than a custom authentication solution would be, it operates as middleware so its mostly transparent and can be used outside of Sinatra should you decide to add additional middleware, custom Rack applications, or Rails to your Rack stack.
The way mongodb operates, where commands are separated from the data, means injections are unlikely so some minimal sanity checking of user inputs should make the risk of database compromises pretty low. As with any database its good practice to never directly put any data into your database from a user without proper bounds checking and escaping.
Make sure users can't input HTML/JS/CSS that can be seen by other users, otherwise your site will likely be vulnerable to XSS.
When possible clearly define all of the possible inputs a user is allowed to choose from, then make sure the input you receive from users matches EXACTLY one of the possible values you defined. If not either reject the input or pick a sane default value.
Good unit testing and broad test coverage can often help reduce unexpected behavior which can sometimes be used to help prevent security problems. Try that out. Certainly couldn't hurt.
Another good practice which can peripherally benefit security is to not reinvent the wheel. Go with hardened, proven, functioning solutions the rest of the community depends on so you can benefit from the insights of others and reap the rewards when someone else finds and fixes a security flaw in a library you use.
There are many other system, database, and application level concerns you may need to address to ensure your application is secure. The scope of your question is a bit too broad to answer without intimate knowledge of your complete system architecture.
表单
如果您有表单，您绝对应该使用真实性令牌，以避免跨站点请求伪造。查看 Sinatra 的 rack_csrf gem。
Cookies / Sessions
如果您启用了会话，由于 Sinatra 实现了基于 cookie 的会话，您应该检查 encrypted_cookie gem作为使用 256 位 AES 算法加密 Sinatra 会话的方法。
最后但并非最不重要的一点是始终使用 HTTPS
阅读
Forms
If you have forms you should definitely use an authenticity token in order to avoid cross site request forgeries. Check out rack_csrf gem for Sinatra.
Cookies / Sessions
If you have have sessions enabled, since Sinatra implements cookie-based sessions you should check encrypted_cookie gem as a mean to encrypt Sinatra’s sessions using 256-bit AES algorithm.
Last but not least always use HTTPS
Read this blog post for a well-rounded explanation.