加密Ajax数据的最佳和最安全的方法是什么？

Question

I'm developing a website where people will be able to register and access different data via Ajax (powered by jQuery). This is all simple and i shall have no problems doing. the issue is that the data showed by Ajax needs to be secure and not available to be parsed through remote scripts. I can encrypted the data through a AES (in PHP) and decrypt successfully in javascript, but the javascript code will always be visible to everyone (after login). I can use an obfuscator and javascript encryption, but both ways, even mixed, are not secure enough and decryptable. I would prefer avoiding SSL connections, since I am trying to prevent registered users from accessing the information and the SSL connection would only prevent unregistered users from accessing the data.

Registered users will be able to earn money therefore very interested in cheating the code, this is why it has to be bulletproof.

Unfortunately the system needs definitely Ajax (the whole working principle needs to be based on Ajax). The ideal solution would be a way to save the encryption key on a place that can be saved by php and accessed by javascript, but not by users, remote script parsers etc.

Does anyone know a way to create a secure Ajax connection for this purpose?

I really appreciate all your help.

Answer 1

You want something that browsers do not do.

You've asked for: "The ideal solution would be a way to save the encryption key on a place that can be saved by php and accessed by javascript, but not by users, remote script parsers etc."

The design of the web browser and javascript engine in the browser is such that any Javascript that the web browser can execute can be seen by a human who wants to look at it, steal it, borrow it, whatever. Period. There is NO such place that can be accessed by Javascript, but not by users or remote script parsers. You will have to rethink how your app works if this is a problem. Most likely, you need to keep the secret stuff on the server and do more work on the server and less work on the client in order to protect what you want to protect. If you think about it, a browser is just a remote script parser so if you prevent remote script parsing, you prevent a browser. If you allow a browser, you allow a remote script parser.

You can obfuscate your Javascript to your heart's content if you want. That will make it a little more work for a human to understand and do something useful with it, but it will only be an additional obstacle that any determined and competent person can defeat if they really want to. If this secrecy is really important to you, then you need to rethink the design of the app so that secret information is not required in the browser and the browser just works as a display and interaction engine.

Just so I'm clear here. Any code that can be executed by a browser must, by definition, be something that any user or any tool can download and inspect. You can use SSL to protect data from snoopers in transport, but it ultimately has to be readable as Javascript for the browser to be able to execute it.

Answer 2

You can't do exactly what you want. It's like a cheat-proof game design. You CAN make it HARDER, even MORE hard, but NOT 100% secure. You've got to solve the problem froma different approach, like, whatever that is, examine the actions at server-side (eg in a stateful manner) and try to detect any non-human behavior. But it's only a matter of someone creating a realistic bot that mimicks the behavior of humans. Encryption is used for preventing 3rd parties -- other than the server and the client -- from eavesdropping/capturing data, NOT for the client. I'm not saying give up on the whole thing, but try a different approach to secure the system. I want to help more, but don't know what exactly you are trying to achieve.

Answer 3

authentication is the only ways to do it.

Just get your users to authenticate (login) and send them the random seed and salt you've used to encrypt their data.

Without the seed/salt, even though a malicious user can decrypt your data it will still be garbage.

If you want javascript to use a piece of data then clients use that data.

If you don't want data to be re-used set up a server-side system where each chunk of data is only valid once.

Proper authentication should solve all these problems.

I want the users to be able to see the data only when Ajax displays them

Then load the data when ajax get's it and not before. Or only partially load data and off-load any sensitive work to the server.

Answer 4

我认为最好的做法是使您的代码（生产代码）过于复杂以至于无法阅读和编辑，您应该使用字母[az]重命名所有变量，而不应该声明ny函数始终在另一个function(){}内部使用function(){}这样，逻辑上更加复杂，客户端仍然可以看到代码，但与代码无关。编辑：我意识到这是一个糟糕的建议