安全＆amp; Pyscript
我正在编码Python编辑器，该编辑器可以执行Python代码并返回输出。我最初的想法是为其编码后端服务，该服务将运行Python脚本并返回输出。但是，随着Pyscript的发布，我想知道我是否可以在前端进行。
我最大的担忧之一是安全性，因为Python编辑器可能需要连接AWS资源（例如数据库，DynamoDB，RDS ...）。使用凭据连接AWS资源是一个安全问题吗？如我所见，Pyscript也使Python代码混淆了，因此我有点困惑。
感谢您的答复
I am coding a Python editor, which can execute python codes and returns the output. My initial idea was to code a backend service for it, that will run the Python script and return the output. However with the release of Pyscript, I am wondering if I can do it in the frontend.
One of my biggest concerns is the security, since the Python editor may need to connect AWS resources (such as Databases, Dynamodb, RDS...). Will using credentials to connect AWS resources be a security concern? As I see, Pyscript is also obfuscating the Python code, thus I am a bit confused.
Thanks for your replies
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的。互联网上有示例。该存储库在浏览器中具有一个示例：
https：/ Pyscript/Pyscript/tree/main/pyscriptjs/示例
这是一个非常大的问题。 Pyscript将在python代码中公开您的凭据，该代码可以从浏览器调试窗口中易于读取，或者仅使用CLI（例如
curl或wget> wget）下载HTML。我不确定您看到的是什么混淆，但是您不能从浏览器或可以下载HTML和Python文件的工具中隐藏任何内容。当您使用Pyscript具有零源代码安全性时，这将无法提高您的安全性。
Yes. There are examples on the Internet. This repository has an example of repl in the browser:
https://github.com/pyscript/pyscript/tree/main/pyscriptjs/examples
This is a very big concern. Pyscript will expose your credentials in the Python code that is easily readable from the Browser debug window or by simply using a CLI such as
curlorwgetto download your HTML.I am not sure what obfuscating you have seen, but you cannot hide anything from the browser or tools that can download your HTML and Python files. This will not improve your security as you have zero source code security with Pyscript.
编辑：请参阅下面的约翰·汉利（John Hanley）的评论，解释了为什么我的想法不起作用。
您无法将凭据放入服务器上的文本文件中的文件夹中，公众无法访问吗？然后在
＆lt; py-script＆gt;标签中，运行：这是否会提供一些略有改进的安全级别？
EDIT: see John Hanley's comment below explaining why my idea wouldn't work.
Couldn't you put the credentials in a text file on server in a folder inaccessible to the public? Then inside the
<py-script>tags, run:Would this provide some marginally improved level of security?
该解决方案使用Py-env标签，但是＆lt; py-script src =“不起作用来管理文件
The solution is using py-env tag, but <py-script src=" doesn't work to manage the file