关于安全:出海企业系列风险分析网站需要验证码吗

50次阅读

共计 6542 个字符，预计需要花费 17 分钟才能阅读完成。

最近接待了几位从 discuz 来的用户，说是想要给本人海内的网站装置验证码，然而 discuz 境外服务器还要解析装置核心的 DNS 到境外服务器上，所以基于 discuz 建站的不好之处就在这里。

而且咱们还探讨到一个问题，海内的网站，须要用到滑动验证码吗？

通过强烈的“大战三百回合”，咱们得出了论断：必须要。

起因有三：

  1. 避免歹意行为：国外的 geek 可比国内的嚣张多了，各种歹意攻打、刷票、撞库、暴力破解明码等
  2. 爱护数据和内容：爬虫什么的，国外分外嚣张，而且各种破解工具开源
  3. 应答垃圾信息和垃圾账号：通过要求用户手动实现滑动验证，能够无效缩小无意义的注册和公布垃圾信息的行为。尤其是对于内容类网站，比如说论坛。

所以说，如果想要做国外的网站或者是 App，那么做好防护是必须的。而简略好用且便宜的动静验证码是首选。

明天就来教大家怎么去在本人海内的网站上装置验证码。

一、前端

01 找到相应的供应商。

能够在 discuz 找（如果是基于 discuz 建站的，那你就只有这一个选项），或者应用极验，或者其余提供收费服务的。咱们以一家小公司 AiSecruis 的 abtCaptcha 为例（链接我就不放了，大家自行抉择适合的即可，有须要能够一起交换：出海交换）。

02 确认本人网站

环境先决条件：兼容 IE8+、Chrome、Firefox 等支流浏览器。

03 激活服务

激活 atbCAPTCHA 服务：创立 Applcation，获取 apiServer、appld、appSecret；

脚本的应用：

<script src="https://cdn.aisecurius.com/ctu-group/captcha-ui/v5/index.js" crossorigin="anonymous" id="as-captcha-script"></script>

留神：  atbCAPTCHA 脚本常常更新，请务必应用 CDN 上的资源获取最新的安全更新。不要在本人的服务器上应用正本。

04 初始化

以下是 valina JavaScript、React 和 Vue 演示。

1）JavaScript 示例

假如 <div id="demo"></div> 页面上有 a，atbCAPTCHA 能够按如下形式初始化。

var myCaptcha = as.Captcha(document.getElementById('demo'), {
  appId: 'your appId', // appId, Obtaining from the console "Application Management" or "Application Configuration" module,
  apiServer: 'https://cap.aisecurius.com',
  // apiServer, The domain name address is obtained in the top left corner of the console page -> atbCAPTCHA -> "Application Management" page. It is a must to fill in it completely, including https://.
  success: function (token) {console.log('token:', token)
    // The atbCAPTCHA token is obtained for back-end verification. Note that if the obtained token is a string starting with sl, it is a downgraded token generated by the front-end network blocked. Please check the front-end network and apiServer address.
  }
})

初始化后，abtCAPTCHA 组件将被插入到<div id="demo"></div>.

2) React 示例

假如页面上有<div id="demo"></div>abtCAPTCHA 能够初始化如下：

// class component use componentDidMount
useEffect(() => {as.Captcha(document.getElementById('demo'), {
    appId: 'appId',
    apiServer: 'https://xxx.xxx.com',
    success: function (token) {console.log('token:', token)
    }
  });
}, [])

初始化后，atbCAPTCHA 组件将被插入到<div id="demo"></div>.

3) Vue 示例

假如页面上有<div ref="demo"></div>abtCAPTCHA 能够初始化如下：

mounted() {
  as.Captcha(this.$refs.demo, {
    appId: 'appId',
    apiServer: 'https://xxx.xxx.com',
    success: function (token) {console.log('token:', token)
    }
  });
}

初始化后，atbCAPTCHA 组件将被插入到<div ref="demo"></div>.

4) 外观及尺寸

atbCAPTCHA 有四种款式：

  • embed 嵌入式（默认），这种款式下宽度默认为 300px，可通过初始化时的 width 参数调节，高度为 200px，高度不可调节
  • inline 内联式，这种款式占用面积较小，宽度默认为 300px，可通过初始化时的 width 参数调节，高度为 40px，高度不可调节
  • popup 弹出式，这种款式验证码默认不可见，调用 .show() 办法后将以浮层的模式展示，宽度为 300px，高度为 200px
  • oneclick 触发式，这种款式占用面积较小，宽度默认为 300px，可通过初始化时的 width 参数调节，高度为 40px，高度不可调节

05 Methods

atbCAPTCHA 实例具备以下办法：

reload()：从新加载以后的 atbCAPTCHA

留神！请不要在胜利回调中调用 reload()，因为开启无感验证时会反复调用胜利回调。

例子：

myCaptcha.reload()

show()：显示以后的 atbCAPTCHA

如果显示以后的 atbCAPTCHA，“style”为“popup”的验证码，默认暗藏。接入用户须要依据页面逻辑调用 show()办法来显示和暗藏以后的 atbCAPTCHA。

例子：

myCaptcha.show()

hide()：暗藏以后验证码

例子：

myCaptcha.hide()

06 Event

abtCAPTCHA 可用于通过以下形式监听事件：

myCaptcha.on('ready', function () {console.log('captcha is ready!')
})

myCaptcha.on('verifySuccess', function (security_code) {console.log('security_code is:' + security_code)
})

myCaptcha.on('hide', function () {console.log('The verification code control is hidden.')
})

具体的款式与语言也是能够自定义操作的，具体能够依据本人的需要来。

二、后端

01 Java 版本

下载 Java7 及以上版本的 SDK。

Maven 依赖

<dependency>
  <groupId>com.aisecurius</groupId>
  <artifactId>ctu-security-sdk</artifactId>
  <version>3.0</version>
</dependency>
/** The initialization parameters are appid and appSecret 
 * The appid is consistent with the appid of the frontend, and the appid can be disclosed 
 * The appSecret is the secret key, please do not disclose it 
 * The token can be obtained after the verification is completed at the frontend and sent to the backend with the your Form/XHR request. The token is valid for two minutes 
 **/
String appId = "appId";
String appSecret = "appSecret";
CaptchaClient captchaClient = new CaptchaClient(appId,appSecret);
CaptchaResponse response = captchaClient.verifyToken(token);
System.out.println(response.getCaptchaStatus());
// A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the network
if (response.getResult()) {/** The token verification passes, to continue other processes **/} else {/** If the token verification fails, you can directly block the request or continue to pop up the CAPTCHA **/}

02 PHP 版本

下载 PHP 版 SDK：点击下载

include ("CaptchaClient.php");
/** The initialization parameters are appid and appSecret 
 * The appid is consistent with the appid of the frontend, and the appid can be disclosed 
 * The appSecret is the secret key, please do not disclose it 
 * The token can be obtained after the verification is completed at the frontend and sent to the backend with the your Form/XHR request. The token is valid for two minutes 
 **/
$appId = "appId";
$appSecret = "appSecret";
$client = new CaptchaClient($appId,$appSecret);
$client->setTimeOut(2);      // Set the timeout, 2 seconds by default; 
$response = $client->verifyToken(token);  // ; The token refers to the value passed from the frontend, that is, the token issued after the verification code is successfully verified
echo $response->serverStatus;
// A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the network
if($response->result){
    echo "true";
    /** the token verification passes, to continue other processes **/
}else{
    echo "false";
    /** Verification failed **/
}

03 Python 版本

Python 版本 SDK 下载：点击下载

from CaptchaClient import CaptchaClient

if __name__ == '__main__':
    APP_ID = '12610axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
    APP_SECRET = 'a3e56cxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
    captchaClient = CaptchaClient(APP_ID, APP_SECRET)
    captchaClient.setTimeOut(2)
    # Set the timeout, 2 seconds by default
    response = captchaClient.checkToken("token")
    print response['serverStatus']
    # A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the network
    print response['result']
    if response['result']:
        # the token verification passes, to continue other processes; 
        pass
    else:
        # If the verification fails, you can directly block the request or continue to pop up the CAPTCHA 
        pass

04 Golang SDK

SDK 下载地址

// Version Go 1.13 

import "./captcha-client"

/** The initialization parameters are appid and appSecret 
 * The appid is consistent with the appid of the frontend, and the appid can be disclosed 
 * The appSecret is the secret key, please do not disclose it 
 * The token can be obtained after the verification is completed at the frontend and sent to the backend with the your Form/XHR request. The token is valid for two minutes 
 **/
appId := "appId"
appSecret := "appSecret"
captchaClient := captcha_client.NewCaptchaClient(appId, appSecret)
//captchaClient.SetTimeout(2000)
// Set the timeout, in milliseconds, 2 seconds by default 
captchaResponse := captchaClient.VerifyToken(token)
// A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the network
//fmt.Println(captchaResponse.Ip)
if captchaResponse.Result {/* The verification passes, to continue other processes  */} else {/* If the verification fails, you can directly block the request or continue to pop up the CAPTCHA  */}

结语

公司出海不容易，或者说，搭一个海内的网站不容易，大家后期的防护肯定要做好，不然就很容易间接被人冲了。

正文完
安全
发表至： 安全
2023-07-13
 0
关于安全:五问五答第三方风险管理
关于安全:分析-H5常见的业务风险及防护思路
关于安全:数安护航专项行动进行时企业数据安全风险如何自查自纠
关于安全:讲解COMP-1043-UO-Problem