Merging other languages

This commit is contained in:
James Miranda
2016-09-23 18:01:10 -03:00
parent 380a8ee74c
commit de3c5bdaa4
490 changed files with 24539 additions and 24588 deletions

View File

@@ -1,9 +1,10 @@
# 9.7 小结
这一章主要介绍了如CSRF攻击、XSS攻击、SQL注入攻击等一些Web应用中典型的攻击手法它们都是由于应用对用户的输入没有很好的过滤引起的所以除了介绍攻击的方法外我们也介绍了了如何有效的进行数据过滤以防止这些攻击的发生的方法。然后针对日异严重的密码泄漏事件介绍了在设计Web应用中可采用的从基本到专家的加密方案。最后针对敏感数据的加解密简要介绍了Go语言提供三种对称加密算法base64、aes和des的实现。
编写这一章的目的是希望读者能够在意识里面加强安全概念在编写Web应用的时候多留心一点以使我们编写的Web应用能远离黑客们的攻击。Go语言在支持防攻击方面已经提供大量的工具包我们可以充分的利用这些包来做出一个安全的Web应用。
## links
* [目录](<preface.md>)
* 上一节: [加密和解密数据](<09.6.md>)
* 下一节: [国际化和本地化](<10.0.md>)
# 9.7 Summary
In this chapter, we've described CSRF, XSS and SQL injection based attacks. Most web applications are vulnerable to these types of attacks due to a lack of adequate input filtering on the part of the application. So, in addition to introducing the principles behind these attacks, we've also introduced a few techniques for effectively filtering user data and preventing these attacks from ever taking place. We then talked about a few methods for securely storing user passwords, first introducing basic one-way hashing for web applications with loose security requirements, then password salting and encryption algorithms for more serious applications. Finally, we briefly discussed two-way hashing and the encryption and decryption of sensitive data. We learned that the Go language provides packages for three symmetric encryption algorithms: base64, AES and DES.
The purpose of this chapter is to help readers become more conscious of the security issues that exist in modern day web applications. Hopefully, it can help developers to plan and design their web applications a little more carefully, so they can write systems that are able to prevent hackers from exploiting user data. The Go language has a large and well designed anti-attack toolkit, and every Go developer should take full advantage of these packages to better secure their web applications.
## Links
- [Directory](preface.md)
- Previous section: [Encrypt and decrypt data](09.6.md)
- Next chapter: [Internationalization and localization](10.0.md)