保护表单提交的公共端点
我有一个 next.js 静态网站，其中有一些表单，例如联系方式、工作申请等。我们的后端是.NET 4.6。由于这些表单是公开的，API 端点（Web 服务）基本上没有身份验证，任何人都可以使用 Postman 等工具开始发出请求。如何确保这些端点的安全？我想到了一些我可以做的事情：
加密这些请求的有效负载，然后在处理之前在后端解密它们。这个想法是，如果其他人可以看到端点 URL，他们仍然无法正确加密数据，端点将拒绝它。出现的问题是，可以使用开发工具检查前端用于加密有效负载的密钥，然后任何人都可以发送正确加密的有效负载。
在后端，检查请求标头以确保引用或原始标头指向我的网站。现在的问题是，有一些工具可以帮助您模仿成功的请求标头，这意味着有人可以使用正确的标头来欺骗请求。
确保这些端点安全的最佳方法是什么？有没有办法限制我的网站只能请求它？或者有没有办法在客户端隐藏加密密钥？关于如何解决这个问题还有其他建议吗？
I have a next.js static website that has some forms such as contact, job applications, etc. Our backend is .NET 4.6. Since these forms are public, the API endpoints (Web services) basically have no authentication and anyone could start making requests using a tool such as Postman. How could I make these endpoints secure ? I thought of a few things I could do:
Encrypting the payloads of these requests and then decrypting them at the backend before processing it. The idea being if someone else can see the endpoint url, they still can't encrypt the data correctly and the endpoint would reject it. The problem arises that the key that frontend uses to encrypt the payload can be inspected using dev tools and then anyone could send correctly encrypted payloads.
At the backend, checking the request headers to make sure that referer or origin headers point to my website. The problem now is that there are tools that can help you imitate a successful request headers, meaning that someone could spoof a request with correct headers.
What would be best way to making those endpoints secure ? Is there a way I can restrict only my website to be able to request it ? Or is there a way to hide the encryption keys on client side ? Any other suggestions on how I could approach this problem ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
由于您的 API 是公开的，并且生成有效负载的 HTML 也是公开的，因此实际上无法保证安全性。
但是，您可以通过使用以下步骤来使其变得更加困难
请求在表单提交期间发送令牌
将从 #1 获取的令牌传递到 #2
或者
您只需限制每个 IP 每小时允许的提交数量。
虽然这不会阻止攻击，但它会减慢他们的速度，使他们能够转向更容易的目标。
Since your API is public and the HTML that generates the payload is public, there is really no way to guarantee security.
However, you could make it harder by using the following steps
Request a token to send during form submit
Pass the token gotten from #1 in #2
OR
You simply limit how many submissions per IP per hour are allowed.
While this will not STOP the attack, it will slow them down enough that they will move to easier targets.