事件验证 - Js Heavy 应用程序真的有必要吗
这件事真的很令人震惊，我一直在考虑事件验证，这真的有必要吗？我正在研究避免事件验证的方法，以构建面向 Web 服务 javascript 的页面，其中根据 Web 服务数据加载下拉列表。我可以禁用页面的事件验证，但我想要一些关于谷歌、雅虎等巨头如何执行此类验证的见解（主要是您认为他们会如何做到这一点）。这些组织都是以公共为基础的，几乎所有服务都使用 Web 服务，严重依赖 ajax 来使事情变得更简单。
我应该如何验证这种情况下的发布值，事件验证是 已禁用。
This thing is really show stopper, i've been thinking about event validation and is this really necessary. I am looking into ways to avoid event validation for building a webservice-javascript oriented page where dropdownlists are loaded based on webservice data. I could disable event validation for the page but i would like some insights(mostly how you think they might do it) as to how biggies like Google, Yahoo perform such validations. These organizations are hugely public based and use web services for almost all their services, rely heavily on ajax for making their things simpler.
How should i validate the post values in the case, event validation is
disabled.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
事件验证确保在页面上触发的任何事件都可以从页面加载时的状态中触发。例如，如果按钮触发 Click 事件，则它会使用哈希算法检查该按钮是否存在于原始页面的 HTML 输出中。
这些哈希值存储在页面上的一个隐藏字段中，称为
__EVENTVALIDATION。这是 ASP.NET Web 窗体提供的故障安全机制，并且如果您以无状态方式正确编码应用程序，则没有必要。例如，如果您的应用程序仅允许某些用户删除文章，那么您的删除按钮事件处理程序最好在触发时检查该用户是否仍然有权删除该文章。不要依赖触发 Button Click 事件的事实来假设用户具有权限。
将此原则应用于应用程序的所有输入。手动检查从下拉列表、单选按钮、复选框等传递的值对于当前页面和状态的用户会话是否有效，并且不依赖 ASP.NET 事件体系结构来验证用户输入。当您确定这一点后，您可以安全地关闭事件验证。
Event Validation ensures that any event that is triggered on the page would have been possible from the state of the page when loaded. e.g. If a Button fires a Click event, then it checks that the button existed in the original page's HTML output by using a hashing algorithm.
These hashes are stored in a hidden field on the page called
__EVENTVALIDATION.This is a fail-safe mechanism provided by ASP.NET Web Forms, and provided you code your application properly, in a state-less fashion, it is not necessary. For example, if your application allows only certain user's to delete an article it is best for your delete button event handler to check that the user still has permission to delete the article when it fires. Do not rely on the fact that the Button Click event was triggered to assume that the user had permission.
Apply this principal to all input into your application. Manually check values passed from drop down lists, radio buttons, check boxes, etc, are valid for the user session for the current page and state and don't rely on the ASP.NET event architecture to validate user input. When you are sure of this, you can safely turn event validation off.