1

我想使用已发布的 GoogleDocs 文档和twitter 推文作为 Silverlight 应用程序的数据源，但遇到了客户端访问策略问题。

我读过很多这样的文章，以及关于绕过客户端访问策略问题的难度。

所以我编写了这个CURL 脚本并将其放在我的 PHP 站点上，现在我可以将任何 GoogleDocs 文档和 twitter 提要的文本获取到我的Silverlight应用程序中：

<?php
$url = filter_input(INPUT_GET, 'url',FILTER_SANITIZE_STRING);

$validUrls[] = "http://docs.google.com";
$validUrls[] = "http://twitter.com/statuses/user_timeline"; 

if(beginsWithOneOfThese($url, $validUrls)) {
  $user_agent = 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)';
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie");
  curl_setopt($ch, CURLOPT_COOKIEFILE, "/tmp/cookie");
  curl_setopt($ch, CURLOPT_URL, $url ); 
  curl_setopt($ch, CURLOPT_FAILONERROR, 1); 
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0); 
  curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); 
  curl_setopt($ch, CURLOPT_TIMEOUT, 15);
  curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
  curl_setopt($ch, CURLOPT_VERBOSE, 0);
  echo curl_exec($ch);
} else
  echo "invalid url";

function beginsWithOneOfThese($main, $prefixes) {
  foreach($prefixes as $prefix) {
    if(beginsWith($main, $prefix))
      return true;
  }
  return false;
}

function beginsWith($main, $prefix) {
    return strpos($main, $prefix) === 0;
}

?>

所以这让我想知道：

  • 为什么有这么多关于 URL 是否支持 clientaccesspolicy 的讨论，因为您只需要编写一个简单的代理脚本并通过它获取信息？
  • 为什么没有提供此功能的服务，例如 URL 缩短服务？
  • 拥有这样的脚本有什么安全隐患？
4

1 回答 1

2

While you might think that a proxy gives you the same capabilities as having the client make the request, it doesn't. More specifically, you won't have the client's cookies/credentials for the target site, and in some cases, a client can reach the target site but your proxy can't (e.g. Intranet).

http://blogs.msdn.com/ieinternals/archive/2009/08/28/Explaining-Same-Origin-Policy-Part-1-Deny-Read.aspx explains Same Origin Policy at some length.

In terms of the security implications for your proxy-- well, that depends on whether you have access control on that. If not, a bad guy could use your proxy to hide his tracks as he hacks sites or downloads illegal content.

于 2010-03-20T19:41:45.077 回答