跨域资源安全策略

发布时间: 2025-03-23 13:22

↑

# 跨域资源安全策略

## CORS机制概述

CORS（Cross-Origin Resource Sharing）是一种浏览器安全机制，用于控制跨域HTTP请求。本文将详细介绍CORS的工作原理、配置方法和安全最佳实践。

## 工作原理

### 1. 基本概念

```javascript
// CORS请求示例
fetch('https://api.example.com/data', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        // CORS请求会自动添加Origin头
    },
    credentials: 'include',  // 发送Cookie
    body: JSON.stringify(data)
});
```

### 2. 请求类型

```javascript
// CORS请求管理器
class CorsRequestManager {
    constructor() {
        this.allowedOrigins = new Set([
            'https://trusted-site.com',
            'https://api.partner.com'
        ]);
    }
    
    // 简单请求检查
    isSimpleRequest(method, headers) {
        const simpleMethods = ['GET', 'HEAD', 'POST'];
        const simpleHeaders = [
            'Accept',
            'Accept-Language',
            'Content-Language',
            'Content-Type'
        ];
        
        // 检查请求方法
        if (!simpleMethods.includes(method)) {
            return false;
        }
        
        // 检查Content-Type
        const contentType = headers['Content-Type'];
        if (contentType) {
            const allowedTypes = [
                'application/x-www-form-urlencoded',
                'multipart/form-data',
                'text/plain'
            ];
            if (!allowedTypes.includes(contentType)) {
                return false;
            }
        }
        
        // 检查自定义头
        const customHeaders = Object.keys(headers)
            .filter(h => !simpleHeaders.includes(h));
        
        return customHeaders.length === 0;
    }
    
    // 预检请求处理
    handlePreflight(origin, method, headers) {
        if (!this.allowedOrigins.has(origin)) {
            return {
                allowed: false,
                reason: 'Origin not allowed'
            };
        }
        
        // 检查请求方法
        const allowedMethods = ['GET', 'POST', 'PUT', 'DELETE'];
        if (!allowedMethods.includes(method)) {
            return {
                allowed: false,
                reason: 'Method not allowed'
            };
        }
        
        // 检查请求头
        const allowedHeaders = [
            'Content-Type',
            'Authorization',
            'X-Requested-With'
        ];
        
        const requestHeaders = Object.keys(headers);
        const hasInvalidHeader = requestHeaders.some(
            h => !allowedHeaders.includes(h)
        );
        
        if (hasInvalidHeader) {
            return {
                allowed: false,
                reason: 'Invalid headers'
            };
        }
        
        return { allowed: true };
    }
}
```

## 实现方案

### 1. Express实现

```javascript
// CORS中间件
class CorsMiddleware {
    constructor(options = {}) {
        this.options = {
            origins: ['https://trusted.com'],
            methods: ['GET', 'POST'],
            headers: ['Content-Type'],
            credentials: true,
            maxAge: 3600,
            ...options
        };
    }
    
    middleware() {
        return (req, res, next) => {
            const origin = req.headers.origin;
            
            // 验证来源
            if (this.isAllowedOrigin(origin)) {
                res.setHeader(
                    'Access-Control-Allow-Origin',
                    origin
                );
                
                // 允许凭证
                if (this.options.credentials) {
                    res.setHeader(
                        'Access-Control-Allow-Credentials',
                        'true'
                    );
                }
                
                // 处理预检请求
                if (req.method === 'OPTIONS') {
                    this.handlePreflight(req, res);
                    return res.end();
                }
            }
            
            next();
        };
    }
    
    isAllowedOrigin(origin) {
        return this.options.origins.includes(origin);
    }
    
    handlePreflight(req, res) {
        // 设置允许的方法
        res.setHeader(
            'Access-Control-Allow-Methods',
            this.options.methods.join(', ')
        );
        
        // 设置允许的头
        res.setHeader(
            'Access-Control-Allow-Headers',
            this.options.headers.join(', ')
        );
        
        // 设置预检结果缓存时间
        res.setHeader(
            'Access-Control-Max-Age',
            this.options.maxAge
        );
    }
}
```

### 2. Spring实现

```java
@Configuration
public class CorsConfig {
    
    @Bean
    public CorsFilter corsFilter() {
        CorsConfiguration config = new CorsConfiguration();
        
        // 允许的域名
        config.addAllowedOrigin("https://trusted.com");
        
        // 允许的方法
        config.addAllowedMethod("GET");
        config.addAllowedMethod("POST");
        config.addAllowedMethod("PUT");
        
        // 允许的头
        config.addAllowedHeader("*");
        
        // 允许凭证
        config.setAllowCredentials(true);
        
        // 预检缓存时间
        config.setMaxAge(3600L);
        
        UrlBasedCorsConfigurationSource source = 
            new UrlBasedCorsConfigurationSource();
            
        source.registerCorsConfiguration(
            "/**", config
        );
        
        return new CorsFilter(source);
    }
}

// 控制器配置
@RestController
@CrossOrigin(origins = "https://trusted.com")
public class ApiController {
    
    @GetMapping("/data")
    public ResponseEntity<?> getData() {
        return ResponseEntity.ok(data);
    }
    
    @PostMapping("/update")
    public ResponseEntity<?> updateData(
        @RequestBody Data data
    ) {
        return ResponseEntity.ok(result);
    }
}
```

## 安全配置

### 1. 配置最佳实践

```javascript
// CORS安全配置
const corsConfig = {
    // 生产环境配置
    production: {
        origins: [
            'https://app.example.com',
            'https://admin.example.com'
        ],
        methods: ['GET', 'POST'],
        headers: [
            'Content-Type',
            'Authorization'
        ],
        credentials: true,
        maxAge: 3600
    },
    
    // 开发环境配置
    development: {
        origins: ['http://localhost:3000'],
        methods: ['*'],
        headers: ['*'],
        credentials: true,
        maxAge: 3600
    },
    
    // API服务配置
    api: {
        origins: [
            'https://api.partner.com',
            'https://api.customer.com'
        ],
        methods: ['GET', 'POST', 'PUT', 'DELETE'],
        headers: [
            'Content-Type',
            'Authorization',
            'X-API-Key'
        ],
        credentials: false,
        maxAge: 7200
    }
};
```

### 2. 安全检查

```javascript
// CORS安全检查器
class CorsSecurityChecker {
    constructor() {
        this.rules = [
            this.checkOrigins,
            this.checkMethods,
            this.checkHeaders,
            this.checkCredentials
        ];
    }
    
    // 检查配置
    checkConfig(config) {
        const results = [];
        
        for (const rule of this.rules) {
            const result = rule.call(this, config);
            if (!result.valid) {
                results.push(result);
            }
        }
        
        return {
            valid: results.length === 0,
            issues: results
        };
    }
    
    // 检查源配置
    checkOrigins(config) {
        const { origins } = config;
        
        if (!origins || origins.length === 0) {
            return {
                valid: false,
                rule: 'origins',
                message: 'No allowed origins specified'
            };
        }
        
        // 检查通配符使用
        if (origins.includes('*')) {
            return {
                valid: false,
                rule: 'origins',
                message: 'Wildcard origin is not recommended'
            };
        }
        
        // 验证URL格式
        const invalidOrigins = origins.filter(origin => {
            try {
                new URL(origin);
                return false;
            } catch {
                return true;
            }
        });
        
        if (invalidOrigins.length > 0) {
            return {
                valid: false,
                rule: 'origins',
                message: 'Invalid origin URLs found'
            };
        }
        
        return { valid: true };
    }
    
    // 检查方法配置
    checkMethods(config) {
        const { methods } = config;
        
        if (!methods || methods.length === 0) {
            return {
                valid: false,
                rule: 'methods',
                message: 'No allowed methods specified'
            };
        }
        
        // 检查危险方法
        const dangerousMethods = [
            'TRACE',
            'TRACK'
        ];
        
        const hasDangerousMethod = methods.some(
            m => dangerousMethods.includes(m)
        );
        
        if (hasDangerousMethod) {
            return {
                valid: false,
                rule: 'methods',
                message: 'Dangerous methods detected'
            };
        }
        
        return { valid: true };
    }
    
    // 检查头配置
    checkHeaders(config) {
        const { headers } = config;
        
        if (!headers || headers.length === 0) {
            return {
                valid: false,
                rule: 'headers',
                message: 'No allowed headers specified'
            };
        }
        
        // 检查敏感头
        const sensitiveHeaders = [
            'Cookie',
            'Authorization'
        ];
        
        if (headers.includes('*')) {
            return {
                valid: false,
                rule: 'headers',
                message: 'Wildcard headers not recommended'
            };
        }
        
        return { valid: true };
    }
    
    // 检查凭证配置
    checkCredentials(config) {
        const { credentials, origins } = config;
        
        if (credentials && origins.includes('*')) {
            return {
                valid: false,
                rule: 'credentials',
                message: 'Credentials with wildcard origin'
            };
        }
        
        return { valid: true };
    }
}
```

## 最佳实践

### 1. 安全建议

1. 源配置
   - 明确指定允许的源
   - 避免使用通配符
   - 使用HTTPS源

2. 方法限制
   - 只允许必要的方法
   - 避免危险方法
   - 区分读写操作

3. 头部控制
   - 限制允许的头
   - 保护敏感头
   - 控制缓存策略

### 2. 开发流程

1. 设计阶段
   - 规划跨域策略
   - 确定安全要求
   - 评估业务需求

2. 实现阶段
   - 配置CORS规则
   - 实施访问控制
   - 处理错误情况

3. 测试阶段
   - 验证跨域行为
   - 测试安全限制
   - 检查错误处理

## 总结

CORS安全策略的实施需要考虑多个方面：

1. 配置管理
   - 环境隔离
   - 精确控制
   - 定期审查

2. 安全防护
   - 多层验证
   - 监控告警
   - 及时响应

3. 最佳实践
   - 遵循标准
   - 安全优先
   - 持续改进

元素码农