ASP.NET MVC中的机器人检测到的未经授权的控制器方法
通过我的应用程序日志，我注意到了以下HTTPException：
“在控制器'myapp.controllers.mycontroller'”
上找不到公共行动方法'myMethod'控制器：“ mycontroller”，操作：“ myaction”（get）
此” 是正常的，因为 myaction 是 post 方法。 但是 mycontroller 可以通过身份验证的用户访问，这要归功于控制器过滤器覆盖handleauthorizedRequest（）方法。 此外， myAction 是由专用于身份验证功能的脚本文件来调用的。
（请注意， myAction 和 mycontroller 不是真实姓名，我在这里更改了它们，而且它们绝对是罕见的名称，如果不阅读JS文件，这些名称是无法猜测的。）
我担心我的应用程序安全。 如何通过未经验证的用户检测到这种控制器方法的存在（根据其IP地址位置是机器人）？我应该怎么做才能避免这个问题？
Through my application log, I have noticed the following HttpException has been raised:
"A public action method 'MyMethod' was not found on controller 'MyApp.Controllers.MyController'"
Controller: "MyController", Action: "MyAction" (GET)
This is normal because MyAction is a POST method.
But MyController can be accessed by authenticated users only, thanks to a controller filter overriding HandleUnauthorizedRequest() method.
Moreover, MyAction is called by Ajax from a Scripts file dedicated to authenticated functionalities.
(Please note that MyAction and MyController are not the real names, I have changed them here, and they are absolutely uncommon names which cannot be guessed without reading the JS file.)
I fear for my application security.
How is this possible that the existence of this controller method has been detected by an unauthentified user (which is a bot according to its IP address location)? What should I do to avoid that issue?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论