关于使用Eth地址发送请求的问题
我有一个问题。最近，我一直在开发带有数据库的 Web3 应用程序，只是为了为用户设置...用户名。问题是用户可以编辑我发送的请求，并且可能切换到像埃隆·马斯克这样的人的地址（例如）并编辑他的名字。我在 opensea 上滚动，发现他们只是在更改用户名时发送类似的请求：
https:// /i.sstatic.net/ECSnw.png
有人可以更改地址并更改埃隆·马斯克的名字（例如）。他们如何做到这一点，以便用户可以只更改他拥有的地址的用户名，而不是从其他任何人那里更改。
I have a problem. Recently I have been working on Web3 app with database just to set a ...Username for a user. The problem is that the user can edit request I'm sending and maybe switches to Address of someone like Elon Musk(for example) and edits his name. I was scrolling on opensea and found out that they just send a request like that when changing the username:
https://i.sstatic.net/ECSnw.png
Someone can just change the address and change the name of Elon Musk(for example). How they do it so the user can just change username of address that he owns and not from anyone other.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
TL;DR 的答案是：您永远不能信任来自客户端的数据。服务器上的代码必须验证所有内容。
服务器上的代码应识别它收到的请求是否来自经过身份验证的用户（即用户已登录并具有有效令牌）。如果用户已“通过身份验证”，则您将继续确定他们是否已“授权”（具有权限）执行操作或查看请求的数据。最后，如果他们经过身份验证（他们是谁）和授权（他们拥有的权限），您仍然必须验证和清理从他们那里获得的任何数据。对您的服务有意义的一切。
这需要大量的工作，而且很容易出错。这就是您采用经过良好测试的库并学习如何使用它的原因。它将为您完成大部分工作，然后您只需担心适用于您的项目的领域。例如，如果“名称”已被其他人使用，是否可以，或者它是否需要是唯一的。是否可以使用脏话，或者应该被拒绝等。
有关更多详细信息，请查看 OWASP 损坏的访问控制< /a>.
The TL;DR answer is: You can NEVER trust data coming from the client-side. The code on the server must validate everything.
The code on the server should identify if the request it received is from an authenticated user (i.e. the user has logged in and has a valid token). If the user is "authenticated", then you proceed to determine if they are "authorized" (have permissions) to perform the action or view the requested data. Finally, if they are authenticated (who they are) and authorized (permissions they have), you still must validate and sanitize any data you get from them. Whatever makes sense for your service.
This is all a lot of work, and it's easy to make mistakes. This is the reason you adopt a well tested library and learn how to use it. It will do much of the work for you, and then you only need to worry about the areas that apply to your project. For example, is it OK if the the "Name" is already in use by someone else, or does it need to be unique. Is bad language OK, or should be rejected, etc.
For more details, look into OWASP Broken Access Control.