blocks|key|860595|text|你问：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|860596|有办法隐藏主键吗？|blockquote|860597|当然有，只是不要提供。让我们回顾一下您当前的URI：|860598|http://example.com/BankAccount/EditBankAccount?bankAccountId=12
+++++++++++++++++++++++++++++++++++++++++++++++%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E%5E|code-block|syntax|javascript|860599|要隐藏主键，请删除它并将其编码为事务-脚本名称的一部分，例如：|860600|http://example.com/BankAccount/EditMyBankAccount
+++++++++++++++++++++++++++++++++++%5E%5E|860601|我强调了不同之处。这个新的事务-脚本不需要提供任何主键，因为它总是编辑当前用户帐户-从来没有不同的一个。|860602|这将有助于您预防不安全的直接对象引用。|offset|length|860603|entityMap|0|LINK|mutability|MUTABLE|url|https://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Direct_Object_References^0|0|0|0|0|0|0|0|8|A|0|0^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|14|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|15|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|16|8|@]|9|@]|A|$J|K]]|$1|L|3|M|5|6|7|17|8|@]|9|@]|A|$]]|$1|N|3|O|5|I|7|18|8|@]|9|@]|A|$J|K]]|$1|P|3|Q|5|6|7|19|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|1A|8|@]|9|@$T|1B|U|1C|1|1D]]|A|$]]|$1|V|3|-4|5|6|7|1E|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]]]

You ask:

<blockquote>
 Is there a way to hide the primary key?
</blockquote>

Sure there is, just do not provide it. Let's review your current URI:

<pre><code>http://example.com/BankAccount/EditBankAccount?bankAccountId=12
 ^^^^^^^^^^^^^^^^
</code></pre>

To hide the primary key, remove it and encode it as part of the transaction-script name, for example:

<pre><code>http://example.com/BankAccount/EditMyBankAccount
 ^^
</code></pre>

I've highlighted the differences. This new transaction-script does not need any primary key provided as it is always about editing the current users account - and never a different one.

This should help you in preventing <a href="https://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Direct_Object_References" rel="nofollow">Insecure Direct Object References</a>.

blocks|key|2564334|text|你可以：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2564335|不给出显式有意义的词来描述查询字符串参数(如：/EditBankAccount?p1=abc&p2=xyz)|ordered-list-item|offset|length|style|CODE|2564336|加密查询字符串参数，这样页面访问者就不会计算出实际值。|2564337|如果适用于您的情况，请在加密参数时使用盐值，以防止彩虹表攻击。将salt密钥存储在会话中。|2564338|保持原样，并将严格的安全授权规则应用于谁应该使用哪个对象的功能(即应用功能和对象级授权)|2564339|当然，第三点将使URL在会话到期后无效。|2564340|entityMap^0|0|N|U|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@$E|U|F|V|G|H]]|9|@]|A|$]]|$1|I|3|J|5|D|7|W|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|X|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|Y|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|Z|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|R|$]]

You may:

<ol>
<li>Not to give explicit meaningful words to describe the query string parameters (like: <code>/EditBankAccount?p1=abc&amp;p2=xyz</code>)</li>
<li>Encrypt the the query string parameters so the page visitor will not figure out the real values</li>
<li>If applicable to your case; use a salt value when encrypting your parameters to prevent rainbow table attacks. Store the salt key in your session.</li>
<li>Keep it as is and apply strict security authorization rules to who should use what functionality on which object (i.e. Apply Functional and Object-Level Authorization) </li>
</ol>

Of course, the 3rd point will make the URL invalid after the session expires.

blocks|key|861576|text|没必要把钥匙藏在网址上。例如，您查看过StackOverflow上的urls吗？到处都是PKs。否则，您将如何理解当前用户正在编辑的哪个银行帐户？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|861577|相反，您应该编写一个授权筛选器，以确保url中提供的id实际上是属于当前通过身份验证的用户的帐户。我已经说明了如何在this+similar+thread中实现这种授权筛选器。|offset|length|style|CODE|861578|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/11494091/29407^0|0|1M|J|1M|J|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@$D|R|E|S|F|G]]|9|@$D|T|E|U|1|V]]|A|$]]|$1|H|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

There's no need to hide the key from the url. For example have you looked around the urls on StackOverflow? You've got PKs hanging everywhere. Otherwise how are you going to understand which bank account is the current user trying to edit?

What you should do instead is to write an authorization filter that will ensure that the provided id in the url actually is an account that belongs to the currently authenticated user. I have illustrated how such authorization filter might be implemented in <a href="https://stackoverflow.com/a/11494091/29407"><code>this similar thread</code></a>.

When I select, for example, an account, from a list of accounts in my view, the URL shows something like:

<blockquote>
 <code>http://example.com/BankAccount/EditBankAccount?bankAccountId=12</code>
</blockquote>

Is there a way to hide the primary key, because northing stops someone from editing the id in the URL and posting it, to get a different account.

I can add code to see if the current user is allowed to view this account, but is there a better way?

Showing the Primary Key is a danger

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

例如，当我从视图中的帐户列表中选择一个帐户时，URL显示的内容如下：http://example.com/BankAccount/EditBankAccount?bankAccountId=12是否有一种方法来隐藏主键，因为northing阻止某人编辑URL中的id并将其张贴，以获得不同的帐户。我可以添加代码来查看当前...

问显示主键是一种危险
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问显示主键是一种危险EN