用户 ID 和用户名
我必须在 AdminUsers.aspx 页面中使用 UserId（以管理用户激活和解锁帐户）。我计划将 UserId 保存为 gridview DataKey 。 但问题是我不知道 userId 是否可以保存在 viewstate 中并暴露给用户。 UserId 是否存在安全问题？
谢谢
I have to use UserId in a AdminUsers.aspx page ( to manage users activation and unLocking accounts ) . I've planned to save UserId as gridview DataKey .
but the problem is that I don't know if userId is ok to be saved in viewstate and be exposed to users . is there any security issue with UserId ?
thanx
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
听起来 UserID 只是您的 User 表的主键。因此，我没有看到任何安全问题。了解内部主键并不能帮助未经授权的访问。
许多数据库使用 Identity (int) 主键。如果系统的设计方式可以通过主键造成损坏，那么恶意用户就可以继续尝试数字。
编辑：刚刚意识到这被标记为 asp.net-membership，所以我认为 UserID 是成员资格使用的 GUID。我仍然不认为这是一个安全问题。这只是一个主键。
It sounds like UserID is just the primary key to your User table. As such, I don't see any security issue. Knowledge of an internal primary key shouldn't help unauthorized access.
A lot of databases use Identity (int) primary keys. If the system was designed in such a way that damage could be done via primary key, then a malicious user could just keep trying numbers.
EDIT: Just realized that this is tagged asp.net-membership, so I presume that UserID is the GUID that membership uses. I still don't see this as a security issue. It's just a primary key.
如果您使用 HttpContext.Current.User.Identity.Name< /a>，那么几乎没有安全风险，因为每个用户都有自己的会话。
If you use HttpContext.Current.User.Identity.Name, then there's little security risk because each user has their own session.
您可以将用户ID以加密格式保存在数据库中。现在在网格视图中您可以有一个隐藏标签。在编辑特定行时，您可以访问隐藏的用户ID并最终解密它......
You can save the UserID in database in encrypted format. Now in the gridview you can have a hidden label. on edit of a specific row you can access the hidden userID and finally decrypt it....