Ajax安全性和代码隐藏功能

Question

EDIT: I know you should never trust client side... My question is what can I use to validate since at the current moment I'm expecting three parameters two of which rely on the client side form (registration email, and email message)

I'm probably going about this the wrong way but it seems like Ajax isn't very secure (well duh..It's client side..) How would you go about creating a function so it cannot be called Via the console by intruders?

So let's say I have a function called SendMail that accepts the to,message and from parameters in which it sends an ajax request to the code behind to send the email.

what can I add that would prevent you from opening the console, recreating my function (except with literal variables ) and executing it via the console?

Code Behind:

<WebMethod()> _
<ScriptMethod(ResponseFormat:=ResponseFormat.Json)>
Public Shared Sub sendMail(subject As String, userEmail As String(), message As String)
    Dim fromEmail As String = "supah@domain.com"
    Dim fromAbrv As String = "hidden Tiger"
    Try
        Dim mail As New MailMessage()
        Dim smtp As New SmtpClient("server.domain")
        mail.From = New MailAddress(fromEmail, fromAbrv)
        For i As Integer = 0 To userEmail.Length - 1
            mail.[To].Add(userEmail(i))
        Next
        mail.Subject = subject
        mail.Body = message
        mail.IsBodyHtml = True
        smtp.Send(mail)
    Catch exc As Exception
        Throw exc
    End Try

End Sub

Answer 1

You cannot trust your clientside code to prevent the client from anything at all. Never ever trust the client. Treat every single request as tampered with and malicious.

Even if you managed to "protect" that function, an attacker could just fake the whole request.

Validate your parameters serverside.

Answer 2

Structure your registration process in a way that prevents this up front.

First, when the registration form is submitted to the server, check for an existing user with that email address. If one exists, return an error message.

If the user doesn't exist, create a new record for the user and flag it as not activated. Next, send the user a registration email with a url that when clicked, activates the account. Do not include any of the information from the original form in this email!

with it setup that way, the most any malicious user can do is send a single activation email to someone.

As far as the reset password form, it shouldn't be possible to use it to send emails to users other than the existing user because you should check the email address in the database, then use the one from the database rather than from the form. Additionally, you should never send the password in an email, instead send a link in an email that sends the user to a page where they can enter a new password.