All geek questions in one place

Guidelines for “Compatible” URL Protection

I am planning a webapp that will allow users to create resources without logging in. I plan to use the Google Docs / Pastebin security style by creating unique hard-to-reach URLs. (e.g. example.com/ytasdfweoirue/)

What things should be observed? What recommendations would you use when developing a token generator? What things should I consider? Is there a better character set to choose from?

My backend will most likely be CouchDB, but I'm interested in platform agnostics, general recommendations and problems that can occur on any platform.

+3
source share
2 answers

Use PRNG

URL- PRNG, Random(). (FYI. .NET GUID , - , )

""

, (javascripts, images, flash- ..). URL REFERRER, URL- . , HTTPS, URL- HTTP .

-, Referrers

REFERRER , , , URL-. ( Open Redirect), JavaScript REFERRER.

0

, Guid. url:

http://whatever.com/resource/ {guid}

, / , , . javascript, , (.net) .

wikipedia : http://en.wikipedia.org/wiki/Globally_unique_identifier

0

Source: https://habr.com/ru/post/1779443/

More articles:


All Articles