elasticsearch ajax,How To Secure Elasticsearch When using ajax

最新推荐文章于 2021-08-06 09:23:37 发布

weixin_39744512

最新推荐文章于 2021-08-06 09:23:37 发布

阅读量116

点赞数

文章标签： elasticsearch ajax

在AJAX环境中，无法直接保护服务器URL，但可以通过确保服务器不易被黑客攻击来增强安全性。关闭ES的脚本执行，限制对外暴露的端口，确保只通过服务器调用ES，并对输入查询进行清理，防止注入攻击。记得限制字符串长度并过滤特殊字符。

摘要由CSDN通过智能技术生成

In the AJAX world, there is no way to secure the server URL. And that's ok; security by obscurity is not a good practice anyway. What you need to do is make sure your server can't be hacked through that URL. A couple of tips:

Disable scripting in ES. The newer versions of ES have it disabled by default out of the box.

Don't expose your bare ES server to the world. By default ES is available on port 9200, which means anyone can run any query (or do anything else they want). Make sure that port is blocked from external access. As one commenter pointed out, the Javascript should be calling your server, which should in turn be calling the ES server as localhost (again, be sure localhost:9200 is blocked from external access) or behind a firewall.

Clean up all input queries before passing them to ES. ES is less vulnerable than SQL to "injection" attacks, but it is still critical to filter out any nasty characters such as \ { " : and so forth, to limit string lengths to something reasonable, etc.

Good luck!