关于安全:出海企业系列风险分析网站需要验证码吗

最近接待了几位从discuz来的用户，说是想要给本人海内的网站装置验证码，然而discuz境外服务器还要解析装置核心的DNS到境外服务器上，所以基于discuz建站的不好之处就在这里。

而且咱们还探讨到一个问题，海内的网站，须要用到滑动验证码吗？

通过强烈的“大战三百回合”，咱们得出了论断：必须要。

起因有三：

避免歹意行为：国外的geek可比国内的嚣张多了，各种歹意攻打、刷票、撞库、暴力破解明码等
爱护数据和内容：爬虫什么的，国外分外嚣张，而且各种破解工具开源
应答垃圾信息和垃圾账号：通过要求用户手动实现滑动验证，能够无效缩小无意义的注册和公布垃圾信息的行为。尤其是对于内容类网站，比如说论坛。

所以说，如果想要做国外的网站或者是App，那么做好防护是必须的。而简略好用且便宜的动静验证码是首选。

明天就来教大家怎么去在本人海内的网站上装置验证码。

一、前端

01 找到相应的供应商。

能够在discuz找（如果是基于discuz建站的，那你就只有这一个选项），或者应用极验，或者其余提供收费服务的。咱们以一家小公司AiSecruis的abtCaptcha为例（链接我就不放了，大家自行抉择适合的即可，有须要能够一起交换：出海交换）。

02 确认本人网站

环境先决条件：兼容IE8+、Chrome、Firefox等支流浏览器。

03 激活服务

激活atbCAPTCHA服务：创立Applcation，获取apiServer、appld、appSecret；

脚本的应用：

<script src="https://cdn.aisecurius.com/ctu-group/captcha-ui/v5/index.js" crossorigin="anonymous" id="as-captcha-script"></script>

留神： atbCAPTCHA 脚本常常更新，请务必应用 CDN 上的资源获取最新的安全更新。不要在本人的服务器上应用正本。

04 初始化

以下是 valina JavaScript、React 和 Vue 演示。

1）JavaScript 示例

假如<div id="demo"></div>页面上有a，atbCAPTCHA能够按如下形式初始化。

var myCaptcha = as.Captcha(document.getElementById('demo'), {  appId: 'your appId', // appId, Obtaining from the console "Application Management" or "Application Configuration" module,  apiServer: 'https://cap.aisecurius.com',  // apiServer, The domain name address is obtained in the top left corner of the console page -> atbCAPTCHA -> "Application Management" page. It is a must to fill in it completely, including https://.  success: function (token) {    console.log('token:', token)    // The atbCAPTCHA token is obtained for back-end verification. Note that if the obtained token is a string starting with sl, it is a downgraded token generated by the front-end network blocked. Please check the front-end network and apiServer address.  }})

初始化后，abtCAPTCHA 组件将被插入到<div id="demo"></div>.

2) React 示例

假如页面上有<div id="demo"></div>abtCAPTCHA 能够初始化如下：

// class component use componentDidMountuseEffect(() => {  as.Captcha(document.getElementById('demo'), {    appId: 'appId',    apiServer: 'https://xxx.xxx.com',    success: function (token) {      console.log('token:', token)    }  });}, [])

初始化后，atbCAPTCHA 组件将被插入到<div id="demo"></div>.

3) Vue 示例

假如页面上有<div ref="demo"></div>abtCAPTCHA 能够初始化如下：

mounted() {  as.Captcha(this.$refs.demo, {    appId: 'appId',    apiServer: 'https://xxx.xxx.com',    success: function (token) {      console.log('token:', token)    }  });}

初始化后，atbCAPTCHA 组件将被插入到<div ref="demo"></div>.

4) 外观及尺寸

atbCAPTCHA 有四种款式：

embed 嵌入式（默认），这种款式下宽度默认为 300px，可通过初始化时的 width 参数调节，高度为 200px，高度不可调节
inline 内联式，这种款式占用面积较小，宽度默认为 300px，可通过初始化时的 width 参数调节，高度为 40px，高度不可调节
popup 弹出式，这种款式验证码默认不可见，调用 .show() 办法后将以浮层的模式展示，宽度为 300px，高度为 200px
oneclick 触发式，这种款式占用面积较小，宽度默认为 300px，可通过初始化时的 width 参数调节，高度为 40px，高度不可调节

05 Methods

atbCAPTCHA 实例具备以下办法：

reload() ：从新加载以后的 atbCAPTCHA

留神！请不要在胜利回调中调用reload()，因为开启无感验证时会反复调用胜利回调。

例子：

myCaptcha.reload()

show() ：显示以后的 atbCAPTCHA

如果显示以后的atbCAPTCHA，“style”为“popup”的验证码，默认暗藏。接入用户须要依据页面逻辑调用show()办法来显示和暗藏以后的atbCAPTCHA。

例子：

myCaptcha.show()

hide() ：暗藏以后验证码

例子：

myCaptcha.hide()

06 Event

abtCAPTCHA 可用于通过以下形式监听事件：

myCaptcha.on('ready', function () {  console.log('captcha is ready!')})myCaptcha.on('verifySuccess', function (security_code) {  console.log('security_code is: ' + security_code)})myCaptcha.on('hide', function () {  console.log('The verification code control is hidden. ')})

具体的款式与语言也是能够自定义操作的，具体能够依据本人的需要来。

二、后端

01 Java版本

下载Java7及以上版本的SDK。

Maven 依赖

<dependency>  <groupId>com.aisecurius</groupId>  <artifactId>ctu-security-sdk</artifactId>  <version>3.0</version></dependency>

/** The initialization parameters are appid and appSecret  * The appid is consistent with the appid of the frontend, and the appid can be disclosed  * The appSecret is the secret key, please do not disclose it  * The token can be obtained after the verification is completed at the frontend and sent to the backend with the your Form/XHR request. The token is valid for two minutes  **/String appId = "appId";String appSecret = "appSecret";CaptchaClient captchaClient = new CaptchaClient(appId,appSecret);CaptchaResponse response = captchaClient.verifyToken(token);System.out.println(response.getCaptchaStatus());// A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the networkif (response.getResult()) {    /** The token verification passes, to continue other processes **/} else {    /** If the token verification fails, you can directly block the request or continue to pop up the CAPTCHA **/}

02 PHP版本

下载PHP版SDK：点击下载

include ("CaptchaClient.php");/** The initialization parameters are appid and appSecret  * The appid is consistent with the appid of the frontend, and the appid can be disclosed  * The appSecret is the secret key, please do not disclose it  * The token can be obtained after the verification is completed at the frontend and sent to the backend with the your Form/XHR request. The token is valid for two minutes  **/$appId = "appId";$appSecret = "appSecret";$client = new CaptchaClient($appId,$appSecret);$client->setTimeOut(2);      // Set the timeout, 2 seconds by default; $response = $client->verifyToken(token);  // ; The token refers to the value passed from the frontend, that is, the token issued after the verification code is successfully verifiedecho $response->serverStatus;// A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the networkif($response->result){    echo "true";    /** the token verification passes, to continue other processes **/}else{    echo "false";    /** Verification failed **/}

03 Python版本

Python版本SDK下载：点击下载

from CaptchaClient import CaptchaClientif __name__ == '__main__':    APP_ID = '12610axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'    APP_SECRET = 'a3e56cxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'    captchaClient = CaptchaClient(APP_ID, APP_SECRET)    captchaClient.setTimeOut(2)    # Set the timeout, 2 seconds by default    response = captchaClient.checkToken("token")    print response['serverStatus']    # A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the network    print response['result']    if response['result']:        # the token verification passes, to continue other processes;         pass    else:        # If the verification fails, you can directly block the request or continue to pop up the CAPTCHA         pass

04 Golang SDK

SDK下载地址

// Version Go 1.13 import "./captcha-client"/** The initialization parameters are appid and appSecret  * The appid is consistent with the appid of the frontend, and the appid can be disclosed  * The appSecret is the secret key, please do not disclose it  * The token can be obtained after the verification is completed at the frontend and sent to the backend with the your Form/XHR request. The token is valid for two minutes  **/appId := "appId"appSecret := "appSecret"captchaClient := captcha_client.NewCaptchaClient(appId, appSecret)//captchaClient.SetTimeout(2000)// Set the timeout, in milliseconds, 2 seconds by default captchaResponse := captchaClient.VerifyToken(token)// A fault-tolerant mechanism is designed in the SDK, response.getResult() will be returned true if there is an exception in the network//fmt.Println(captchaResponse.Ip)if captchaResponse.Result {    /* The verification passes, to continue other processes  */} else {    /* If the verification fails, you can directly block the request or continue to pop up the CAPTCHA  */}

结语

公司出海不容易，或者说，搭一个海内的网站不容易，大家后期的防护肯定要做好，不然就很容易间接被人冲了。