使用“不可猜测”的方法应用程序源文件的 URL
我目前正在开发适用于 Android 的内部 Phonegap 应用程序。该应用程序将指向存储在我们公司面向公众的 Windows Web 服务器上的 html 文件。该应用程序将使工作人员能够访问存储在我们服务器上的文件和信息。
他们将访问的数据不会被视为超级敏感数据，但仍然需要保持私密性。
为了使应用程序尽可能简单，如果用户不被强制登录就好了。在无法猜测的 URL 上发布 HTML 文件是否会被认为“足够安全”？该 URL 将被编程到应用程序中，并且该应用程序只会安装在我们指定的手机上。
I am currently working on an internal Phonegap app for Android. The app will point to html files stored on our companies public facing windows web server. This app will give workers access to files and information stored on our servers.
The data they will be accessing would not be considered super sensitive data, but it still needs to stay private.
In an effort to make the app as simple as possible, it would be nice if users were not forced to login. Would it be considered "secure enough" to publish the HTML files at an unguessable url? The url would be programmed into the app, and the app would only be install on phones we specify.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
通过默默无闻来实现安全很少是答案。我会回答“否”。
您应该在允许访问文件之前对应用程序进行身份验证。这并不意味着用户必须登录，只是应用程序可以访问。
Security through obscurity is rarely the answer. I'll answer No.
You should do something that authenticates the app before allowing access to the files. This doesnt mean the user has to log in, just that the app has access.
如果该应用程序是通过公共 Wi-Fi 使用的，那么任何拥有数据包嗅探器的人都可以推测出相关的 URL。如果甚至提到“私有”这个词，那么我会说通过默默无闻的安全性并不能解决这个问题。您能否缓存凭据，以便用户只需输入一次（或每月一次）？
Anyone with a packet sniffer would be able to divine the urls in question if the app is used over a public Wi-Fi. If the word private is even being mentioned then I would say that security through obscurity isn't going to cut it. Could you cache the credentials so that users only need to enter them once (or once a month)?
在我看来，如果足够安全，您应该考虑使用难以猜测的 URL。这可以通过在资源的 URL 中使用 GUID 来完成。这与连接一样安全，因此如果您使用 HTTP，中间的任何人都可以看到 URL，然后访问资源。如果这是一个问题，您应该考虑使用 HTTPS。
By secure enough, it sounds to me that you should be considering a hard to guess URL. This can be accomplished by using GUIDs in the URL to your resources. This is only as secure as the connection so if you are using HTTP, anyone in the middle can see the URL and then get to the resources. If that is an issue, you should consider using HTTPS.