ajax调用的安全问题
当调用AJAX调用时，调用请求和响应可以通过使用firebug在控制台上看到。这是一个重大的安全问题。我们如何从控制台隐藏响应（数据）？
有什么选择吗？
When calling the AJAX call, the call request and response can see on console by using the firebug. This is major security issue. How can we hide the response(data) from the console?
Is there any option?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
数据到达客户端这一事实意味着客户端有权读取数据并对其执行任何操作。现在，如果该数据存在安全风险，那么首先就不应该将其发送给客户端。
如果您担心客户端以外的其他人可能会看到它，请使用 HTTPS。
如果您担心人们可以在萤火虫中看到它，那么客户端不应该看到该数据。 隐藏 firebug 只会让它变得更难，而不是不可能。您可能总是使用 Fiddler 来查看 HTTP 内容，甚至使用wireshark 来查看数据包。
The fact that the data is arrived in the client means client has the authority to read and do whatever it wants with it. Now if that data is a security risk, then it should never be sent to the client in the first place.
If you are worried that someone other than the client might see it then use HTTPS.
If you are worried that people can see it in the firebug, well then that data is not supposed to be seen by client. Hiding firebug is only making it harder, not impossible. You may always use Fiddler to see HTTP content or even wireshark to see the packets.
您永远无法真正隐藏发送给客户端的内容，如果您想处理敏感操作，您应该在您控制的服务器上执行此操作。
不知道你想做什么，这是我能告诉你的......
You can never really hide something you send to the client, if you want to handle sensitive operations you should do so on a server you control.
Not knowing what it is you want to do, this is about what i can tell you...
如果您不担心最终用户查看数据，而是担心“中间”的人，那么也许您应该使用 https
If you're not concerned by the end user seing the data but someone "in the middle" then maybe you should use https