正确连接前端和后端的正确方法？

Question

Right now both my servers are working well and in sync using ajax to GET and POST requests(Json) to my backend. Problem is i doubt this is a secure way to achieve my goal. I have a few questions.

1. My understanding of it is that the client is directly accessing the back end through the webpage/ajax, not the front end . Is this a correct way of thinking of it?

2. Would the solution be to grab the data from the user then send it through the node server that's running the front end then post that to the back end?

3. Is there where ssl steps in?

4. In the current method the backend address( http://backend.com/data ) is public, is this a problem?

5. Is there a checklist that covers basic webpage security? I can't seem to find one.

This is my javascript code in the HTML of my webpage

    $.ajax({
      type: 'GET',
      url: 'http://backend.com/data',
      success: function(data) {
        extresults = data;
        console.log(extresults);
      }
    });

    $.ajax({
        type: 'POST',
        url: 'http://backend.com/data',
        data: {"la" : "lala"},
          success: function(data) {
        alert("post is good");
      }
    });

Answer 1

I'm having a little trouble understanding what you mean by client vs "client server", so I'm going to answer this at a slightly higher level of abstraction.

Starting at the most basic level, a connection needs to have three properties before you can begin to call it secure; confidentiality, verification, and validation.

A secure connection must be confidential ; that is, a third party cannot read or modify the data being communicated. This property is usually provided by cryptography, via HTTPS (for web applications). If the data is encrypted in transit, a third party will be unable to read it, as they lack the requisite key. In addition, in a well-designed cryptosystem, an attacker will be unable to modify the data in a useful way. They can substitute in random data, but, without the key, they have no way of sending a message that will decrypt to the data they want to send. Either the decryption will fail, or it will decrypt to some unpredictable value.

A secure connection must be verified , meaning that both parties to the communication need to know who the other party is. On the server-side, HTTPS provides this property; the server presents their HTTPS certificate, and the client knows that only the owner of a certificate can present it in this manner. Therefore, if the client trusts the certificate, meaning that they trust the issuer of the certificate to have verified that the owner of the certificate is who they say they are, they know that the server is who they think it is (This is a gross oversimplification, and I advise looking up how HTTPS actually works). On the server side, however, you need some other method of verifying the client's identity; you don't need a certificate to be a client in an HTTPS connection (although you can use one! I'd look up HTTPS client certificates). This is handled through some method of "logging in". Usually, the client starts the connection as a nobody, and provides some information to the server that proves that the client has a certain identity; a username and password, a signature, an OTP, etc. Once the client has proven their identity, the server typically gives them a cookie, containing a value demonstrating that they have proven their identity; a large random nonce, a signed token, etc.

Finally, a secure connection must be validated . Even if you know that your data has not been tampered with, and you have verified who you're talking to, you still shouldn't blindly trust the data you receive. The client doesn't care as much about the data it receives from the server, but it is absolutely vital to validate the data the server receives from the client. This means that you shouldn't put any data you receive from the client into a command invocation, an SQL query, etc. You also shouldn't rely on any client data for sensitive program flow; don't check if a user is an admin by looking for an "admin=True" argument in their request. Always validate that the data you are receiving is what you are expecting before you do anything with it.

In summary, you should install a certificate on your server and setup HTTPS; require the client to authenticate (through some method) before you accept any data; and validate incoming data before you use it.