瀹夊叏寮�鍙戣鑼?/p>
1)
瀵规湇鍔″櫒璧勬簮璁块棶杩涜鏍￠獙
鎺ㄨ崘鏂瑰紡锛氬鍏紑鐨勮闂?/p>
url
浠?/p>
/pub/
寮�濮嬶紝鍦?/p>
webapp
涓缓绔?/p>
filter
锛屽鎵�鏈夐潪
/pub/
鐨勮闂?/p>
url
杩涜杩囨护锛屾湭鐧婚檰鐢ㄦ埛涓嶅厑璁歌闂紝瀵逛簬鏈嶅姟鍣ㄧ殑鍥剧墖浠ュ強
css
锛?/p>
js
璧勬簮锛屽簲褰撲互
nginx
浣滀负鍔ㄩ潤鍒嗙
2)
Nginx
涓殑鐗规畩鏂囦欢鍚庣紑
.git|.svn|.cvs
杩涜灞忚斀锛屼緥濡?/p>
location ~ ^(.*)/.svn/{
deny all;
}
3)
韬唤璁よ瘉搴旈伩鍏嶅鎴风鍚戞湇鍔″櫒鍙戦�佹槑鏂囧瘑鐮侊紝鍦ㄩ潪
ssl
鐜涓嬶紝搴斿綋閲囩敤
md5+salt
锛岀洂
闀垮害澶т簬
5
涓旀暟瀛椾笌澶у皬鍐欒嫳鏂囩粨鍚堟柟寮忥紝
鏈嶅姟鍣ㄥ湪鏀跺埌鍔犲瘑鐨勫瘑鐮佸悗锛?/p>
鍦ㄥ瓨鍌ㄤ笌楠岃瘉鍓嶈繘
琛屼簩娆″姞瀵嗗姣?/p>
4)
瀵逛簬鏁忔劅淇℃伅
(
濡傝韩浠借瘉涓庨摱琛屽崱
)
锛屾湇鍔″櫒鍦ㄥ啓鍏ユ渶缁堝瓨鍌ㄥ墠锛屽簲褰撹繘琛屽彲閫嗗姞瀵嗭紝濡?/p>
DES
鍔犲瘑
/
瑙ｅ瘑锛屽皢瀵嗛挜鏀句簬鍐呯綉鏈嶅姟鍣ㄤ笂锛屾祴璇曠幆澧冨簲褰撴棤娉曡幏寰楃敓浜х幆澧冨瘑閽ワ紝鍗宠В鍐?/p>
鐮斿彂浜哄憳鐩楄蛋鏁版嵁鐨勯闄?/p>
5)
韬唤楠岃瘉鎻愮ず淇℃伅搴斿綋涓?/p>
鈥?/p>
鐢ㄦ埛鍚嶅拰瀵嗙爜閿欒
鈥?/p>
锛屽敖閲忛伩鍏?/p>
鈥?/p>
鐢ㄦ埛鍚嶉敊璇?/p>
鈥?/p>
鍜?/p>
鈥?/p>
瀵嗙爜閿欒
鈥?/p>
6)
鎺ュ彛搴斿綋灏介噺浣跨敤
HTTP
POST
鏂瑰紡鎻愪氦鏁版嵁锛岄伩鍏嶄娇鐢?/p>
GET
鏂瑰紡锛岄潪鍐呴儴鎺ュ彛鎻愪緵鏁版嵁
搴斿綋浣跨敤
https
7)
鍦ㄨ繛缁娆″け璐ュ悗
(
閫氬父涓?/p>
5
娆′互涓?/p>
)
锛屾墽琛岄攣瀹氬笎鎴锋搷浣滐紝閿佸畾鏃堕棿搴斾笉灏忎簬
30
鍒嗛挓锛?/p>
閬垮厤琚皾璇曟毚鍔涚牬瑙ｄ笌瀵嗙爜鐚滄祴
搴旈伩鍏嶅急瀵嗙爜锛?/p>
8
-
20
浣嶄互鍐咃紝鏁板瓧涓庡ぇ灏忓啓瀛楁瘝缁撳悎鏂瑰紡锛岀敱浜庡墠鍚庡彴闈炴槑鏂囦紶杈擄紝寮卞瘑
鐮佹娴嬪簲褰撳湪瀹㈡埛绔笌
js
绔畬鎴?/p>
8)
鍙戦�佺煭淇￠獙璇佺爜銆?/p>
閭欢搴斿綋浠ラ獙璇佺爜鎷︽埅闈炴硶璇锋眰锛岄獙璇佺爜涓?/p>
4
-
6
浣嶆暟瀛椾笌瀛楁瘝缁撳悎锛屽甫
骞叉壈绾匡紝楠岃瘉鐮佸簲褰撳湪涓�娆￠獙璇佸悗锛屾棤璁烘纭笌閿欒閮介噸鏂扮敓鎴愶紝鍗曚綅鏃堕棿鍐?/p>
(
閫氬父涓?/p>
2
鍒?/p>
閽?/p>
)
璇锋眰楠岃瘉鐮佺殑娆℃暟搴斿綋鍦?/p>
10
娆′互鍐咃紝閬垮厤楠岃瘉鐮佽鐚滄祴鏀诲嚮
9)
浣跨敤閭欢鎵惧洖瀵嗙爜鍔熻兘锛岄偖浠舵湁鏁堟椂闀垮簲褰撳皬浜?/p>
2
灏忔椂
10)
闄ら潪涓氬姟闇�瑕侊紝搴斿綋灏介噺閬垮厤鍚屼竴
ID
鐨勫苟鍙戠櫥闄嗭紝鍗冲悓涓�
ID
鍚庣櫥褰曠敤鎴峰簲褰撹涪鎺夊墠鐢?/p>
鎴?/p>
11)
鐢ㄦ埛浼氳瘽鏍囪瘑
token
搴斿綋鍦?/p>
http
鐨?/p>
cookie
涓垨
head
鐨勫叾浠栦綅缃紝涓嶅厑璁稿皢浼氳瘽鏍囪瘑鎷?/p>
鎺ュ叆
GET
璇锋眰鐨勫弬鏁版垨
url
涓?/p>
12)
鐧婚檰鏃ュ織鐨勮褰曪細灏嗙敤鎴凤紝鐧婚檰鏃堕棿锛岀櫥闄?/p>
ip
璁板綍鍏ョ郴缁熸棩蹇楁垨瀛樺偍涓庡叧绯诲瀷涓庨潪鍏崇郴
鍨嬫暟鎹簱锛屽彲寮傛鍐欏叆
13)
Nginx
鏃ュ織搴斿綋灏介噺杈撳嚭
"$request_time"
"$upstream_response_time"
鐢ㄦ潵瀹氫綅鍝嶅簲鎱㈣
姹?/p>
14)
绯荤粺鐧藉悕鍗曪細瀵逛簬鍏抽敭鎬т笟鍔★紝鍐呴儴閫氫俊搴斿綋閲囩敤
ip
鍐呴儴鐧藉悕鍗曟柟寮忥紝浠呭彈闄?/p>
ip
鍙
闂紝
ip
鐧藉悕鍗曞彲浠ラ噰鐢?/p>
iptables
闃茬伀澧欐嫤鎴笌
filter
杩涜
ip
杩囨护鏂瑰紡
15)
鍔犲叆
XSS
杩囨护
filter
锛屽師鐞嗭細閲囩敤
Decorator
妯″紡锛岀敤缁ф壙
HttpServletRequestWrapper
鐨?/p>
XssHttpServletRequestWrapper
鍦?/p>
getParameter
涓鏌ュ師鍙傛暟锛屾娴?/p>
xss
鍏抽敭瀛楋紝
鍚岀悊寤虹珛闃?/p>
SQL
娉ㄥ叆
filter
涓庨槻
webshell
鐨?/p>
filter
锛岀郴缁熷簲灏介噺閬垮厤
jsonp
杩欑杩滅▼璺ㄥ煙璋冪敤
16)
鍔犲叆闃?/p>
CC
鏀诲嚮
filter
锛屽姩闈欏垎绂诲悗瀵?/p>
ip
杩涜璁℃暟锛屾瘡
2
鍒嗛挓娓呴櫎
ip
璁℃暟锛岃鏁伴噰鐢?/p>
concurrentHashMap<String,Integer>
鏂瑰紡锛屽姣忓垎閽熻姹傝秴杩?/p>
100
鐨?/p>
ip
杩涜闄愬埗锛屽悓鏃跺缓绔?