ICEFaces 安全
我的客户提出了两个安全问题，但我陷入了困境。
为了避免浏览器缓存敏感信息，客户端的安全准则要求 POST 请求不返回 200 响应。最初，我设置了一个 PhaseListener 来处理这个问题，但唯一收到的请求是 GET。我发现客户安全团队抱怨的 POST 请求是对 BlockingServlet 的 ajax 调用。我该如何为此设置类似的东西？我真的不明白icefaces如何处理存储在表单上的信息以及如何确保浏览器不存储此信息。我已经实现了无缓存标头，但这并不是完全可靠的安全性。
我使用的phaseListener基本上是 http://balusc.blogspot.com /2007/03/post-redirect-get-pattern.html
客户端还担心输入参数未经过正确验证，为 XSS 提供了入口点。他们给出的例子也是通过blockingServlet。我怀疑 ICEFaces 内置了一些东西来处理这个问题，但我找不到任何有关它的信息。有人可以帮忙吗？
I have 2 security concerns that my client has come up with and I am stuck.
In order to avoid browsers caching sensitive information, the client's security guidlines require that POST requests do not return 200 response. Initially I set up a phaseListener to deal with this but the only requests that came through were GETs. I discovered that the POST request the client's security team were complaining about were ajax calls to the BlockingServlet. How can I set up something similar for this? I don't really understand how icefaces deals with the information stored on a form and how I can ensure that this info is not stored by the browser. I have implemented the no-cache headers but that's not exactly solid security.
The phaseListener I used was basically http://balusc.blogspot.com/2007/03/post-redirect-get-pattern.html
The client is also concerned that input parameters are not properly validated providing a entry point for XSS. The example they gave was also going through the blockingServlet. I suspect that ICEFaces has something built in to deal with this but I can't find any information about it. Can anyone help?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
XSS 是一个输出问题，你不能通过一些神奇的函数塞满所有的输入数据并期望你的应用程序 100% 安全，免受 XSS 攻击。这对任何应用程序都不起作用，因为 XSS 根本不会那样工作。确保测试您的应用程序是否存在 XSS 和 SQL 注入等漏洞，有免费的解决方案，例如 Sitewatch 和开放的解决方案来源skipfish。
为了防止缓存，请确保设置此 http 标头元素：
Cache-Control: no-store不应使用其他方法。
XSS is an output problem, you can't cram all input data though some magic function and expect your application to be 100% safe from xss. This will never work for any application, because XSS just doesn't work that way. Make sure you test your application for vulnerability like XSS and SQL Injection, there are free solutions like Sitewatch and the open source skipfish.
To prevent caching make sure this http header element is set:
Cache-Control: no-storeNo other method should be used.