外文文獻翻譯---web應(yīng)用程序的基本安全做法-其他專業(yè)-資料下載頁
2025-01-19 09:00本頁面
【導(dǎo)讀】保護您的Web應(yīng)用程序。以下各部分提供了適用于所有Web應(yīng)用程序的最低。解您的用戶；防止惡意用戶的輸入；安全地訪問數(shù)據(jù)庫；創(chuàng)建安全的錯誤消息；保證敏感信息的安全；安全地使用Cookie；防止拒絕服務(wù)威脅。Web應(yīng)用程序安全性建議；程序安全性也會失敗。未經(jīng)授權(quán)的用戶無法訪問它、關(guān)閉它、帶走它，等等。件系統(tǒng)，不使用FAT32。運行監(jiān)視網(wǎng)站通信量的病毒檢查程序。了解和安裝來自Microsoft. 和其他供應(yīng)商的最新安全更新。使用Windows事件日志記錄，并且經(jīng)常檢查這。些日志，以查找可疑活動。的Web服務(wù)器發(fā)出數(shù)量巨大的請求。將您的Web應(yīng)用程序的文件保存在應(yīng)用程序根目錄。若要僅允許已授權(quán)。在顯示不受信任的信。息之前，對HTML進行編碼以將潛在有害的腳本轉(zhuǎn)換為顯示字符串?！懊舾行畔ⅰ笔切枰Ｃ艿娜我庑畔ⅰ榱俗層脩籼囟ǖ男畔⒈３挚捎?，Cookie是一種容易而有用的方法。不要將用戶的密碼存儲在Cookie中，即使是暫時存儲也不要這樣做。將Cookie的過期日期設(shè)置為可以設(shè)置的最短時間。Secure和HttpOnly屬性設(shè)置為true。
【正文】 Sensitive information is any information that you need to keep private. A typical piece of sensitive information is a password or an encryption key. If a malicious user can get to the sensitive information, then the data protected by the secret is promised. Follow these guidelines: If your application transmits sensitive information between the browser and the server, consider using Secure Sockets Layer (SSL). Use Protected Configuration to secure sensitive information in configuration files such as the or files. For more information, see Encrypting Configuration Information Using Protected you must store sensitive information, do not keep it in a Web page, even in a form that you think people will not be able to view (such as in server code).Use the strong encryption algorithms supplied in the System Security Cryptography namespace. 8 . Use Cookies Securely Cookies are an easy and useful way to keep userspecific information available. However, because cookies are sent to the browser39。s puter, they are vulnerable to spoofing or other malicious use. Follow these guidelines: Do not store any critical information in cookies. For example, do not store a user39。s password in a cookie, even temporarily. As a rule, do not store any sensitive information in a cookie that. Instead, keep a reference in the cookie to a location on the server where the information is located. Set expiration dates on cookies to the shortest practical time you can. Avoid permanent cookies if encrypting information in cookies. Consider setting the Secure and HttpOnly properties on your cookies to true. 9. Guard against DenialofService Threats An indirect way that a malicious user can promise your application is by 7 making it unavailable. The malicious user can keep the application too busy to service other users, or if nothing else can simply crash the application. Follow these guidelines: Close or release any resource you use. For example, always close data connections and data readers, and always close files when you are done using error handling (for example, try/catch blocks). Include a finally block in which you release resources in case of IIS to use throttling, which prevents an application from using a disproportionate amount of CPU. Test size limits of user input before using or storing size safeguards on database queries to help guard against large queries using up system can also use the RequestLengthDiskThreshold property in to reduce the memory overhead of large uploads and form posts.
試題試卷相關(guān)推薦
鄂ICP備17016276號-1